How do I create a search which detects password changes and finds the last time the password was changed?

[eputnam]

Hello,

I am working on a Splunk search to see which users have changed their passwords more than a specific number of times over a specific timeframe.

Basically, I want to create a search which detects any Password changes and then looks back to find the last time the password was changed. If it was too soon, alert.

Here is what I currently have for my search which shows password changes. Any assistance on what else I need to add to this search string would be a great help.

index=wineventlog EventCode=4723 status=success user=* |fields user, _time | table user, _time | rename user AS "User"

[DalJeanis · Accepted solution]

Okay, for Splunk searches, any time you start talking about "first I get THIS information... then I go back and get THIS information..." you probably will end up with a really inefficient search.

Instead, you should usually think in terms of "I gather all the events that are like THIS, and then aggregate them THIS way to see whether they meet THESE criteria."

In this case, however, I think you can do it the way you said, but you will have to set explicit earliest and latest time modifiers for each part of the search. In this sample, this is coded for finding all password changes in the last fifteen minutes and adding up how many times each of those users changed their passwords in the last 24 hours. We use eventstats for the calculation, so it will add up the information and add it to the event records but retain the entire selected events for review in the case of the users that have

index=wineventlog EventCode=4723 status=success user=* earliest=-24h@m latest=@m
   [ index=wineventlog EventCode=4723 status=success user=* earliest=-15m@m latest=@m|table user]
| eventstats count as PwdChanges max(_time) as maxtime by user
| where PwdChanges>=3
| sort 0 user - _time

[danielransell]

After collecting your events and specifying your fields you need to get a count of events by user. To do that you add the following after “fields user, _time”:
|stats count by user | ...rest of search

Once you have a count, you will likely want to only show users that have changed their password x number of times during your specified timeframe. To do that add the following after |stats count by user
|where count > 24 |...rest of search.
By adding that, only users who have changed their password more than 24 times will be returned.

Try adding and tweaking those two suggestions and let us know if that gets you what you were looking for.