What Search can monitor Password Changed not by Automation?

[Eyal]

Hi Splunk Community,

I need a Splunk Query that monitors a password change in the DC log source that was not performed by the user from log source X (DC);

Rather to be performed by an automation of the system itself log source Y (Automated Password System).

I want to trigger the search only in case the password change event was received and from that point to search 10 minutes back to see if the trigger was the system itself or an actual user.

Can you please assist 🙂

[Eyal]

Hi PickleRick (Very Nice Name),

I see what you mean let me check this and will update ASAP if it worked 🙂

[PickleRick]

Before we dig deeper into the search itself, question is whether the same search run later on earlier data works properly. If it does even though on the initial run it gave you a false positive, it would mean that your data flow is inconsistent and your events are delayed.

I do suspect there is something wrong with quality of your data and/or data flow because you're searching into the future (earliest=-10m latest=+4m)

[Eyal]

Hi, 

I have tuned my question maybe you can help? 🙂

[PickleRick]

Actually, it's not a question about _how_ to search in Splunk but rather _what_ to search for.

And here you need a windows guy who will tell you what kind of events you need in the first place.