Hello Splunkers,
I wanted to setup an alert for changing password parameters for ex, we have policy of 15 min characters which includes at least 1 number lowercase , 1 number uppercase , 1 special characters I want an alert to trigger if someone modifies this password rule.
Thanks!
Where do you have this policy? In what system? And how is it connected with Splunk?
Thanks for your response @PickleRick
We defined the policy in Splunk cloud SH.
Connection SHC -- IDXR -- FORWARDER
OK. If you mean the password policy within the Splunk itself, you should be able to find it in the _configtracker index (I'm not sure if it's available for Cloud but I assume it is) - look for changes to authorize.conf file.