topic Re: Password reset events in Splunk Enterprise Security

Password reset events

EMDEEEEE — Thu, 25 Sep 2025 16:30:09 GMT

Can someone provide queries for the below

Password reset events for a user

interactive and non interactive login attempts

Account disable event for a user

thanks

Re: Password reset events

richgalloway — Thu, 25 Sep 2025 17:20:04 GMT

What have you tried so far and how have those efforts not met expectations?

To help with this question, we need more information.

What platform/service is performing the password resets, login attempts, and account disables?
Are those events sent to Splunk? If not, then no query will work. Otherwise, it would help to see sample sanitized events.

Re: Password reset events

livehybrid — Thu, 25 Sep 2025 19:08:24 GMT

Hi @EMDEEEEE

What are the logs you are ingesting that you are looking for? There are a number of existing searches in the Splunk Security Essentials app (https://splunkbase.splunk.com/app/3435) and also at https://research.splunk.com/detections/ which might help you, it ultimately depends on the data you are ingesting.

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful

Marking it as the solution if it resolved your issue

Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing.

Re: Password reset events

PrewinThomas — Fri, 26 Sep 2025 06:50:38 GMT

@EMDEEEEE
As others mentioned you need provide more context. If its for Windows Logs in Splunk, you can use below,

Password reset event id's are 4723 and 4724

index=YOUR_INDEX sourcetype="WinEventLog:Security" (EventCode=4723 OR EventCode=4724) | eval Action=case(EventCode=4723,"Password Change Attempt", EventCode=4724,"Password Reset") | table _time user Account_Name Target_Account_Name Action host | sort - _time

Interactive & Non-interactive
Successful logons are EventCode 4624. The Logon_Type field tells you the type.

Interactive: 2 (console), 10 (remote desktop), 11 (cached) and rest you can normally mention as non-interactive

Account Disabled - Use EventCode 4725

index=YOUR_INDEX sourcetype="WinEventLog:Security" EventCode=4725 | eval Action="Account Disabled" | table _time Target_Account_Name user host Action | sort - _time

Regards,
Prewin
If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

Re: Password reset events

thahir — Sun, 28 Sep 2025 08:48:14 GMT

@EMDEEEEE

If you haven’t integrated Splunk users with LDAP or SAML, then user management activities (like account edits, password resets, or role changes) are logged in the _audit index. You can search with something like below SPL in the SH.

index=_audit action=edit_user

However, if your Splunk environment is integrated with Active Directory/Windows authentication, account lifecycle events (disable/enable, password resets, etc.) won’t appear in _audit. Instead, you’ll need to rely on Windows Security Event Logs indexes — for example:

4722 → User account enabled

4725 → User account disabled

4723/4724 → Password change/reset