Splunk Search

Transaction based alert trigger for EventCode=4740 showing previous 60 minutes events

Path Finder

Good morning.

I am looking to generate an alert for when EventCode=4740 (User lockout) is shown in the event logs from my DC. I would like the report of triggered alert to show the previous 60 minutes (or maxevents=15) leading up to the EventCode=4740 lock out (trigger).

Ultimately this would create a report we could send to the user to show that they are locked out and how the lock out was generated.

index=myindex sourcetype="WinEventLog:Security" EventCode=4740 OR EventCode=4771 Account_Name=Username | transaction startswith=EventCode=4771 endswith=EventCode=4740 maxspan=1h

This is my current attempt but it is not producing the information that I need in the format that I need.

If anyone has any ideas then they would be gratefully appreciated.

Thanks,

Rob.

1 Solution

SplunkTrust
SplunkTrust

can you please try this:

index=myindex sourcetype="WinEventLog:Security" EventCode=4740 OR EventCode=4771 Account_Name=Username 
| transaction startswith=eval(EventCode=4771) endswith=eval(EventCode=4740) maxspan=1h maxevents=15

View solution in original post

Path Finder

Hi.

Thanks for your quick response. One thing I was not aware of was the inclusion of the EventCode=4740 within the body of the EventCode=4771 event. I could not understand why I was seeing two EventCode's where I was expecting only 4770 as the most recent event but actually only seeing EventCode=4771

I believe that your suggestion should work perfectly.

Thank you.

0 Karma

SplunkTrust
SplunkTrust

the most recent event will be at down as time is in ascending order. so | transaction startswith=eval(EventCode=4771) endswith=eval(EventCode=4740) maxspan=1h maxevents=15 will check within 1h the event that startswith 4771 and endswith 4740. maybe it is because of maxevents=15 if you remove that you should get events with 4740 as well. so basically within 15 events if you get both of these then only it will show. try removing it or adjusting it.

Path Finder

I appreciate your help.

This was my finished search which seems to be getting the results:

index=myindex sourcetype="WinEventLog:Security" EventCode=4740 OR EventCode=4771 | transaction Security_ID startswith=eval(EventCode=4740) maxspan=1h maxevents=10 unifyends=false

Again, much appreciated.

0 Karma

SplunkTrust
SplunkTrust

I have converted to an answer. Upvote/accept if it is working for you!

0 Karma

SplunkTrust
SplunkTrust

can you please try this:

index=myindex sourcetype="WinEventLog:Security" EventCode=4740 OR EventCode=4771 Account_Name=Username 
| transaction startswith=eval(EventCode=4771) endswith=eval(EventCode=4740) maxspan=1h maxevents=15

View solution in original post

Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!