Active Directory User Lockout Report

[soniquella]

Good morning.

I hope you can help?

I have an existing dashboard which reports on user lock out orientated event codes from our DC's.

index=index_name sourcetype="WinEventLog:Security" EventCode=4740 OR EventCode=4771 OR EventCode=4625
|eval Source=case(EventCode==4771,Client_Address,EventCode==4740,Caller_Computer_Name,EventCode==4625,Source_Network_Address)
| eval Account_Name=if(EventCode==4771,Account_Name,mvindex(Account_Name,1)) | eval Account_Domain=case(EventCode==4771,Security_ID,EventCode==4740,Account_Domain,EventCode==4625,mvindex(Account_Domain,1))
| table _time, EventCode, Account_Name, Account_Domain, ComputerName, Source

Ultimately, I would like to generate a report whereby if a user is locked out (EventCode=4740) the previous 60 minutes log attempts are recorded showing source machine and also the machine which the user is attempting to connect to.
I will then go on to generate a script to put this in to e-mail format so that I can automatically e-mail the user with this report when they are locked out.

Can anyone help? To clarify, the EventCode=4740 would be the trigger and then I would need the previous 60 minutes log attempts including source machine and destination machine in a report. Would this be a transaction or span command?

Any help would be appreciated.

Kind regards,

Rob.

[JordanPeterson]

We have a similar setup:

(host=dc*) source=WinEventLog:Security (EventCode=4740) (Target_Account_Name!=localadmin OR user!=localadmin) 
| eval Account=if(Target_Account_Name!=NULL, Target_Account_Name, user) 
| eval Machine=if(Caller_Machine_Name!=NULL, Caller_Machine_Name, Caller_Computer_Name) 
| fillnull Value="Unknown" Machine 
| eval Time=strftime(_time, "%m/%d/%y %H:%M:%S") 
| dedup Time, Account 
| dedup Account, Machine 
| table Time, Account, Machine

This will result in giving us the Time, Account, and Machine where the lockout occurred but it doesn't include the previous logs. We have it setup to then email our HelpDesk team inbox so they can reach out to the user (fortunately we are a small enough company this is reasonable).