Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- How do you identify all accounts not automatically...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I need to check how to identify all technical accounts that are not automatically locked after 5 consecutive failed log in attempts
Please help with the query
Thanks,
Sahil
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
When an account gets locked out, Active Directory sends out EventCode=4740. So, if you are indexing AD security logs, you could check for lock-outs using
index=wineventlog EventCode=4740 Account_Name=* ..... shows all locked accounts.
index=msad | timechart span=5m sum(badPwdCount) AS total by sAMAccountName ... gives count of lockouts for each user.
So, you can run the 2nd search to check for lockout counts and check if you have a 4740 event for that user. If there is no record, that could potentially indicate an account not getting locked out.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
When an account gets locked out, Active Directory sends out EventCode=4740. So, if you are indexing AD security logs, you could check for lock-outs using
index=wineventlog EventCode=4740 Account_Name=* ..... shows all locked accounts.
index=msad | timechart span=5m sum(badPwdCount) AS total by sAMAccountName ... gives count of lockouts for each user.
So, you can run the 2nd search to check for lockout counts and check if you have a 4740 event for that user. If there is no record, that could potentially indicate an account not getting locked out.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I checked Above query but not worked , Can you give me proper query so that I can test, May be query is right but some argument is missing.
Thanks,
Sahil
Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform
Calling All Security Pros: Ready to Race Through Boston?
Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...
