Activity for a privileged account previously disabled and recently rehabilitated

[wvalente]

Hi Guys,

I need a help to set up a search that alert me when a privileged account was disabled and after habilited in a certain period of time.

I have no idea how I can construct this search.

Help, please.

Tks guys.

[gcusello]

Hi wvalente,
I'm not sure abut the EventCode but they should be 4722 (enabled) and 4725 (disabled) so you should try something like this

index=wineventlog sourcetype=WinEventLog:Security (EventCode=4722 OR EventCode=4725)
| transaction Account_Name 
| search EventCode=4722 EventCode=4725

| in this way you create an event that correlate all events of each Account_Name, if there are both EventCode 4722 and 4725 you can trigger an alert.
You can manage time in in earliest and latest.

Bye.
Giuseppe

[wvalente]

Hi Giuseppe,

Sorry, I was looking for linux devices.

Do you know?

Tks

[gcusello]

it's the same thing, only different field names:

 index=your_index sourcetype=your_sourcetype (EventCode=4722 OR EventCode=4725)
 | transaction user 
 | search EventCode=4722 EventCode=4725

Bye.
Giuseppe