topic Check for event that has not changed for X days in Splunk Search

Check for event that has not changed for X days

Branden — Wed, 13 Nov 2019 18:48:03 GMT

Hello.

I'm struggling with a query. We want to search Windows Event logs for accounts whose passwords have not been changed (by admins) for more than 700 days. I have created a query that informs me of when a password was changed:

 index=main host=*DC* EventCode=4724 | eval Modifier = mvindex(Account_Name, 0) | eval User_Name = mvindex(Account_Name, 1) | rename Group_Name AS Modified_Group | table _time Modifier User_Name

But I do not know how to get Splunk to check for a password that has NOT been changed for over X days. Is this even possible?

Thank you in advance for your help.

Re: Check for event that has not changed for X days

ololdach — Wed, 13 Nov 2019 19:09:30 GMT

Hi Branden,

I think the answer is quite easy, but not what you expect:
- Install the SA-ldapsearch (Splunk Supporting Add On for Active Directory) https://splunkbase.splunk.com/app/1151/
- do an LDAP-Search on your tree and look for (objectClass=shadowAccount) and the field shadowLastChange (date of last password change)

Hope it helps
Oliver

Re: Check for event that has not changed for X days

Branden — Wed, 13 Nov 2019 19:13:33 GMT

Thank you for your response. We have an AD environment and a separate LDAP environment (running on Linux). Your solution would work for our LDAP logs, but for AD all I have to go by are the Windows Event Logs.

Re: Check for event that has not changed for X days

ololdach — Thu, 14 Nov 2019 06:04:01 GMT

Hi Branden, the solution works fine with AD, provided you get a read-only AD user set up in your AD domain. If you can't get access, though, this page tells you the right messages to get into splunk and look for: https://blogs.manageengine.com/active-directory/2018/08/23/monitoring-service-account-password-changes-active-directory.html
Best
Oliver

Re: Check for event that has not changed for X days

Branden — Fri, 15 Nov 2019 17:08:14 GMT

You were absolutely right. I misunderstood what you were saying.
I worked with one of our admins and we have the query working. You're right - it's quite an easy solution. Thank you very much!