Splunk Search

Setup an alert for Changing password parameters?

iamsplunker
Communicator

Hello Splunkers,

I wanted to setup an alert for changing password parameters for ex, we have policy of 15 min characters which includes at least 1 number lowercase , 1 number uppercase , 1 special characters I want an alert to trigger if someone modifies this password rule.

 

 Thanks!

Labels (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Where do you have this policy? In what system? And how is it connected with Splunk?

0 Karma

iamsplunker
Communicator

Thanks for your response @PickleRick 
We defined the policy in Splunk cloud SH.

Connection SHC -- IDXR -- FORWARDER

0 Karma

PickleRick
SplunkTrust
SplunkTrust

OK. If you mean the password policy within the Splunk itself, you should be able to find it in the _configtracker index (I'm not sure if it's available for Cloud but I assume it is) - look for changes to authorize.conf file.

0 Karma
Get Updates on the Splunk Community!

Modern way of developing distributed application using OTel

Recently, I had the opportunity to work on a complex microservice using Spring boot and Quarkus to develop a ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had 3 releases of new security content via the Enterprise Security ...

Archived Metrics Now Available for APAC and EMEA realms

We’re excited to announce the launch of Archived Metrics in Splunk Infrastructure Monitoring for our customers ...