Splunk Search

Transaction based alert trigger for EventCode=4740 showing previous 60 minutes events

soniquella
Path Finder

Good morning.

I am looking to generate an alert for when EventCode=4740 (User lockout) is shown in the event logs from my DC. I would like the report of triggered alert to show the previous 60 minutes (or maxevents=15) leading up to the EventCode=4740 lock out (trigger).

Ultimately this would create a report we could send to the user to show that they are locked out and how the lock out was generated.

index=myindex sourcetype="WinEventLog:Security" EventCode=4740 OR EventCode=4771 Account_Name=Username | transaction startswith=EventCode=4771 endswith=EventCode=4740 maxspan=1h

This is my current attempt but it is not producing the information that I need in the format that I need.

If anyone has any ideas then they would be gratefully appreciated.

Thanks,

Rob.

1 Solution

mayurr98
Super Champion

can you please try this:

index=myindex sourcetype="WinEventLog:Security" EventCode=4740 OR EventCode=4771 Account_Name=Username 
| transaction startswith=eval(EventCode=4771) endswith=eval(EventCode=4740) maxspan=1h maxevents=15

View solution in original post

soniquella
Path Finder

Hi.

Thanks for your quick response. One thing I was not aware of was the inclusion of the EventCode=4740 within the body of the EventCode=4771 event. I could not understand why I was seeing two EventCode's where I was expecting only 4770 as the most recent event but actually only seeing EventCode=4771

I believe that your suggestion should work perfectly.

Thank you.

0 Karma

mayurr98
Super Champion

the most recent event will be at down as time is in ascending order. so | transaction startswith=eval(EventCode=4771) endswith=eval(EventCode=4740) maxspan=1h maxevents=15 will check within 1h the event that startswith 4771 and endswith 4740. maybe it is because of maxevents=15 if you remove that you should get events with 4740 as well. so basically within 15 events if you get both of these then only it will show. try removing it or adjusting it.

soniquella
Path Finder

I appreciate your help.

This was my finished search which seems to be getting the results:

index=myindex sourcetype="WinEventLog:Security" EventCode=4740 OR EventCode=4771 | transaction Security_ID startswith=eval(EventCode=4740) maxspan=1h maxevents=10 unifyends=false

Again, much appreciated.

0 Karma

mayurr98
Super Champion

I have converted to an answer. Upvote/accept if it is working for you!

0 Karma

mayurr98
Super Champion

can you please try this:

index=myindex sourcetype="WinEventLog:Security" EventCode=4740 OR EventCode=4771 Account_Name=Username 
| transaction startswith=eval(EventCode=4771) endswith=eval(EventCode=4740) maxspan=1h maxevents=15
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...