- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
In Splunk Enterprise Security, how do I make a query that shows user account creation and deletion over time?
IWilsonR
Engager
12-13-2018
09:02 PM
I need a query that shows Unix user Account Creation And Deletion within 24 hours time.
Right now, i have this below query which throws a result when a user is created or deleted.
index=Linux_os eventtype="linux_sec" (eventtype=useradd OR eventtype=userdel) user=* dest=* name=* | eval time=strftime(_time,"%Y-%m-%d %H:%M:%S")|stats list(dest) as Destination list(name) as Action list(time) as Time by user
I need a query that shows Account Creation And Deletion within 24 hours time. Please help
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
whrg
Motivator
12-14-2018
05:16 AM
Hello @IWilsonR,
I found a question on SplunkAnswers which is very similar to yours: Account Creation And Deletion within a given time.
Try this search using the transaction command:
index=Linux_os eventtype="linux_sec"
| transaction user startswith=eventtype=useradd endswith=eventtype=userdel maxevents=2
| where duration<24*3600
This should work too:
index=Linux_os eventtype="linux_sec"
| transaction user startswith=eventtype=useradd endswith=eventtype=userdel maxevents=2 maxspan=24h
