Splunk Enterprise Security

How to find LDAP accounts that have been disabled for longer then 30 days

gthomas719
New Member

Hi everyone.
I'm new to Splunk and trying to work on a search that would return accounts in LDAP that have already been disabled for 30 days or longer. I have found that the event code for disabled accounts is 4725, and I can see accounts that have been set to disable within the last 30/60/90... days, but not sure how to see ones that have been sitting in disabled status for 30 days or longer

Any assistance is MUCH appreciated!

0 Karma

damiensurat
Contributor

so you can use the timestamp from the event data and then calculate in seconds the diff between now and the date of the event
timestamp. this can be used to generate a new field which will give you the offset in time in days:

your splunk search
| eval now = now()
| eval secDiff = (now - _time)
| eval ageOfLastEventInDays = round(secDiff/86400,2)
| search ageOfLastEventInDays >= 30

0 Karma

gthomas719
New Member

So would the search look like this:

index="wineventlog" EventCode=4725
| eval now = now()
| eval secDiff = (now - _time)
| eval ageOfLastEventInDays = round(secDiff/86400,2)
| search ageOfLastEventInDays >= 30

0 Karma

Prakash493
Communicator

Their is a way to determine if any users has not been logged to splunk from last 30 days but if you are looking for ldap disabled accounts , if its indexed then you can get it.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...