The antiquity of user passwords

[julian0125]

Hello Splunkers!

I really need your help, is there a way to know the antiquity of user passwords in Linux / Unix / AIX OS on Splunk? and what can i do to recieve this kind of logs and how to see it on Splunk?

Thanks

[sduff_splunk]

Depending on your setup, you could get password change events. This should tell you the time a user last changed their password. You can then assume that any account that hasn't had a password change event in 30/60/90 days.

In the Splunk TA for nix, there is an eventtype defined as the following that is used to identify password change events, or calculate the time since the last change event.

[linux-password-change]
search = (NOT sourcetype=stash) process=passwd password changed
#tags = account management password modify