Deployment Architecture

Help with Windows dormant enable search

debjit_k
Path Finder

Hi All, 

I want to create a use case where the account is inactive for 60 days and it got enable after 60 days.. 

I tied to draw ta logic but not sure whether query is correct or not.

Can somebody please modify the query if it required some change 

index=wineventlog EventCode=4624 user=”*@xyz.com" earliest= -60d latest = now() | transaction user maxspan=60d search (EventCode!=)

 

Thank you 

Labels (4)
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...