Hi Fellow Splunkers,
I need to create a report for this event codes.
4720 A user account was created.
4722 A user account was enabled.
4723 An attempt was made to change an account's password.
4724 An attempt was made to reset an accounts password.
4725 A user account was disabled.
4726 A user account was deleted.
4738 A user account was changed.
4740 A user account was locked out.
4767 A user account was unlocked.
4780 The ACL was set on accounts which are members of administrators groups.
4781 The name of an account was changed.
4794 An attempt was made to set the Directory Services Restore Mode administrator password
5376 Credential Manager credentials were backed up.
5377 Credential Manager credentials were restored from a backup.
Most of the eventcodes have some two values on the fields, that's why fI need to use mvindex to get the appropriate values.
Here is my current search string. I want to know how to simplify it or what is the correct approach for this use case so I can have correct values and normalize values that all fields should be common to be used at the result.
Thank you in advance.
sourcetype=WinEventLog:Security (EventCode=4781 OR EventCode=4720 OR EventCode=4722 OR EventCode=4723 OR EventCode=4724 OR EventCode=4725 OR EventCode=4726 OR EventCode=4738 OR EventCode=4767) NOT (Account_Name="*$" OR Account_Name="ANONYMOUS LOGON") earliest=-24h@h
| eval Account_Domain=(mvindex(Account_Domain,0))
| eval Changeby=mvindex(Account_Name,0)
| eval TargetUser=mvindex(Account_Name,1)
| eval Message=split(Message,".")
| eval Message=mvindex(Message,1)
| eval Date=strftime(_time, "%m/%d/%y %H:%M:%S")
|append [search sourcetype=WinEventLog:Security (EventCode=4740) earliest=-24h@h
| eval Account_Domain=(mvindex(Account_Domain,0))
| eval Changeby=mvindex(Account_Name,1)
| eval TargetUser=if(EventCode=4740,mvindex(Account_Name,1),TargetUser)
| eval Message=split(Message,".")
| eval Message=mvindex(Message,1)
| eval Date=strftime(_time, "%m/%d/%y %H:%M:%S")]
| append [search sourcetype=WinEventLog:Security (EventCode=4781) earliest=-24h@h
| eval Account_Domain=(mvindex(Account_Domain,0))
| eval Changeby=mvindex(Account_Name,0)
| eval TargetUser=mvindex(Account_Name,1)
| eval Alert = "From " .Old_Account_Name + " To ".New_Account_Name
| eval Date=strftime(_time, "%m/%d/%y %H:%M:%S")]
| table Date, EventCode, Changeby TargetUser Old_Account_Name EventCodeDescription, Account_Domain, Caller_Computer_Name, Message, Short_Message, Alert
| sort -Date
... View more