Your best bet for this is to create a lookup with the associated accounts in it. Create a table with the account name and the associated account. You should have a CSV file that looks like this:
src_nt_domain,src_user,assoc_user
XXX,Sara,Sara1
XXX,Sara,Sara2
XXX,Tom,Tom87
Whatever is appropriate to your environment. You can do this with an ldapsearch:
|ldapsearch domain=XXX search="(&(objectClass=user)(!(objectclass=computer)))" attrs="sAMAccountName" | rename sAMAccountName as assoc_user | eval isAssoc=if(match(assoc_user,"\d+$"),1,0) | where isAssoc=1 | rex field=assoc_user "^(?<src_user>.*?)\d+$" | eval src_nt_domain=XXX | table src_nt_domain,src_user,assoc_user | outputlookup associated_users.csv
Now, with that lookup, you can do what you want:
sourcetype=WinEventLog:Security (EventCode=629 OR EventCode=4725) | lookup associated_users src_nt_domain,src_user OUTPUT assoc_user | ldapfilter domain=$src_nt_domain$ search="(sAMAccountName=$assoc_user$)" attrs="userAccountControl" | where userAccountControl!="*DISABLE*" | stats values(assoc_user) by src_nt_domain,src_user
What you will get is a table with the domain and username of the newly-disabled user and the list of associated accounts that have not been disabled yet.
(Note: search commands have not been verified independently, since I don't have your environment)
... View more
