disabled user activity

[108246]

Hello

I'm looking for suggestions on a rule for : showing activity from a disabled user account.

The following rule is what i have created, let me know if you think it can be tweaked or other any other query which you think does the job best.

signature="Account is currently disabled" Workstation_Name!=XXXXXXX | table _time,user,signature,Workstation_Name,EventCode

Regards
Arun

[ben_leung]

Maybe you can use index=_* user=* action="login attempt", and from there narrow down what you want with inactive or disabled user accounts. There are other values in action that could benefit what you want. Hope this helps.

[108246]

Thanks Ben