topic Re: Splunk Dashboard Query to Monitor Inactive Accounts in Getting Data In

Splunk Dashboard Query to Monitor Inactive Accounts

Rosie2287 — Thu, 04 Apr 2024 15:02:37 GMT

Is there a query I can add to my splunk dashboard that will list accounts inactive over 35 days?

Re: Splunk Dashboard Query to Monitor Inactive Accounts

gcusello — Thu, 04 Apr 2024 15:15:58 GMT

if you want to list the accounts used in the last 90 days that weren't used in the last 35 days, you could run something like this:

I could be more detailes knowing which kind of logs yu want to monitor, are they Windows?

in this case I use index=wineventlog and EventCode=4624.

index=wineventlog EventCode=4624 earliest=-90d latest=now | eval period=if(_time>now()-35*86400,"Last","Previous") | stats dc(period) AS period_count values(period) AS period BY Account_name | where period_count=1 AND period="Previous" | table Account_name

Ciao.

Giuseppe

Re: Splunk Dashboard Query to Monitor Inactive Accounts

Rosie2287 — Thu, 04 Apr 2024 15:31:51 GMT

Thank you for this but I am not sure if it will work for my set up since logs are deleted weekly. These are windows events.

Do you have a query that may identify all enabled accounts and when their last login date was?

Re: Splunk Dashboard Query to Monitor Inactive Accounts

ITWhisperer — Thu, 04 Apr 2024 15:46:28 GMT

If the information has been deleted, Splunk can't report on it.

Re: Splunk Dashboard Query to Monitor Inactive Accounts

Rosie2287 — Thu, 04 Apr 2024 15:48:53 GMT

Our splunk server keeps the logs for a lot longer. Sorry I was unclear.