Security

How to identify each Active Directory Service Accounts that are being used for authentication?

znc2
Engager

I need to identify each Active Directory Service Accounts that are being used for authentication for my work group. I am trying to create a working list of active and disabled accounts. I am using the following, but not having any luck obtaining all Events with complete list of EventCodes. 

index=xxxxxxxxxx inserted group*Svc source="xxxxxxxxx"
| rex field=Account_Name "(?<Account_Name_parsed>[\w]*)\@.*"
| where isnotnull(Account_Name_parsed)
| eval startDate=strftime(strptime(whenCreated,"%Y%m%d%H%M"), "%Y/%m/%d %H:%M")
| eval endDate=strftime(strptime(accountExpires,"%Y-%m-%dT%H:%M:%S%Z"), "%Y/%m/%d %H:%M")
| eval lastDate=strftime(strptime(lastTime,"%Y-%m-%dT%H:%M:%S"), "%Y/%m/%d %H:%M")
| eval Days=floor((now()-strptime(lastDate,"%Y/%m/%d %H:%M"))/(3600*24))
| rex field=userAccountControl "(?<userAccountControl_parsed>[^,]+)"
| eval userAccountControl=lower(replace(mvjoin(userAccountControl_parsed, "|"), " ", "_"))
| eval status=case(
match(userAccountControl, "accountdisable") , "disabled",
1==1, "active"
)
| stats first(_time) AS Time by Account_Name_parsed
| eval Time=strftime(Time, "%b %d %H:%M:%S")

The only thing showing in Statistics is the account name and time. I need for my list to show active and non-active accounts. I would also like for the Source_Workstation to be shown as well. I have attached an example of fields within an event.Fields 1.PNGFields 2.PNGFields 3.PNG

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Please share the SPL you tried.

The stats command may not show results if one of the grouping fields is null.  Use fillnull before calling stats to help with that.

The eventstats command shouldn't be computing values you didn't ask for, but you can always get rid of the unwanted field with | fields - field-name.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The report is showing only account name and time because that is what it is told to display by the stats command near the end.  You can modify the command to include other fields or use the eventstats command.

Inactive accounts are unlikely to generate events, since they're not active.

---
If this reply helps you, Karma would be appreciated.
0 Karma

znc2
Engager

Hello @richgalloway ,

When I add other fields in the stats command it eliminates any Statistics from showing. Why is this happening? When using the eventstats command it provided the average duration which I don't need that.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please share the SPL you tried.

The stats command may not show results if one of the grouping fields is null.  Use fillnull before calling stats to help with that.

The eventstats command shouldn't be computing values you didn't ask for, but you can always get rid of the unwanted field with | fields - field-name.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...