Getting Data In

Active Directory User Lockout Report

soniquella
Path Finder

Good morning.

I hope you can help?

I have an existing dashboard which reports on user lock out orientated event codes from our DC's.

index=index_name sourcetype="WinEventLog:Security" EventCode=4740 OR EventCode=4771 OR EventCode=4625
|eval Source=case(EventCode==4771,Client_Address,EventCode==4740,Caller_Computer_Name,EventCode==4625,Source_Network_Address)
| eval Account_Name=if(EventCode==4771,Account_Name,mvindex(Account_Name,1)) | eval Account_Domain=case(EventCode==4771,Security_ID,EventCode==4740,Account_Domain,EventCode==4625,mvindex(Account_Domain,1))
| table _time, EventCode, Account_Name, Account_Domain, ComputerName, Source

Ultimately, I would like to generate a report whereby if a user is locked out (EventCode=4740) the previous 60 minutes log attempts are recorded showing source machine and also the machine which the user is attempting to connect to.
I will then go on to generate a script to put this in to e-mail format so that I can automatically e-mail the user with this report when they are locked out.

Can anyone help? To clarify, the EventCode=4740 would be the trigger and then I would need the previous 60 minutes log attempts including source machine and destination machine in a report. Would this be a transaction or span command?

Any help would be appreciated.

Kind regards,

Rob.

0 Karma

JordanPeterson
Path Finder

We have a similar setup:

(host=dc*) source=WinEventLog:Security (EventCode=4740) (Target_Account_Name!=localadmin OR user!=localadmin) 
| eval Account=if(Target_Account_Name!=NULL, Target_Account_Name, user) 
| eval Machine=if(Caller_Machine_Name!=NULL, Caller_Machine_Name, Caller_Computer_Name) 
| fillnull Value="Unknown" Machine 
| eval Time=strftime(_time, "%m/%d/%y %H:%M:%S") 
| dedup Time, Account 
| dedup Account, Machine 
| table Time, Account, Machine

This will result in giving us the Time, Account, and Machine where the lockout occurred but it doesn't include the previous logs. We have it setup to then email our HelpDesk team inbox so they can reach out to the user (fortunately we are a small enough company this is reasonable).

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...