Security

disabled user activity

108246
New Member

Hello

I'm looking for suggestions on a rule for : showing activity from a disabled user account.

The following rule is what i have created, let me know if you think it can be tweaked or other any other query which you think does the job best.

signature="Account is currently disabled" Workstation_Name!=XXXXXXX | table _time,user,signature,Workstation_Name,EventCode

Regards
Arun

Tags (1)
0 Karma

ben_leung
Builder

Maybe you can use index=_* user=* action="login attempt", and from there narrow down what you want with inactive or disabled user accounts. There are other values in action that could benefit what you want. Hope this helps.

0 Karma

108246
New Member

Thanks Ben

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...