Getting Data In

Active Directory User Lockout Report

soniquella
Path Finder

Good morning.

I hope you can help?

I have an existing dashboard which reports on user lock out orientated event codes from our DC's.

index=index_name sourcetype="WinEventLog:Security" EventCode=4740 OR EventCode=4771 OR EventCode=4625
|eval Source=case(EventCode==4771,Client_Address,EventCode==4740,Caller_Computer_Name,EventCode==4625,Source_Network_Address)
| eval Account_Name=if(EventCode==4771,Account_Name,mvindex(Account_Name,1)) | eval Account_Domain=case(EventCode==4771,Security_ID,EventCode==4740,Account_Domain,EventCode==4625,mvindex(Account_Domain,1))
| table _time, EventCode, Account_Name, Account_Domain, ComputerName, Source

Ultimately, I would like to generate a report whereby if a user is locked out (EventCode=4740) the previous 60 minutes log attempts are recorded showing source machine and also the machine which the user is attempting to connect to.
I will then go on to generate a script to put this in to e-mail format so that I can automatically e-mail the user with this report when they are locked out.

Can anyone help? To clarify, the EventCode=4740 would be the trigger and then I would need the previous 60 minutes log attempts including source machine and destination machine in a report. Would this be a transaction or span command?

Any help would be appreciated.

Kind regards,

Rob.

0 Karma

JordanPeterson
Path Finder

We have a similar setup:

(host=dc*) source=WinEventLog:Security (EventCode=4740) (Target_Account_Name!=localadmin OR user!=localadmin) 
| eval Account=if(Target_Account_Name!=NULL, Target_Account_Name, user) 
| eval Machine=if(Caller_Machine_Name!=NULL, Caller_Machine_Name, Caller_Computer_Name) 
| fillnull Value="Unknown" Machine 
| eval Time=strftime(_time, "%m/%d/%y %H:%M:%S") 
| dedup Time, Account 
| dedup Account, Machine 
| table Time, Account, Machine

This will result in giving us the Time, Account, and Machine where the lockout occurred but it doesn't include the previous logs. We have it setup to then email our HelpDesk team inbox so they can reach out to the user (fortunately we are a small enough company this is reasonable).

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...