About mchandrasekaran

mchandrasekaran · ‎10-11-2016

yeah, but you aren't doing a filter on whether the account lockout is caused by the login failure or not,right?

mchandrasekaran · ‎10-11-2016

I think It isn't working because the fields PwdResets,LoginFailures and password changes are not getting populated for any of the users. There are users that have 4625 and 4740, I checked that as well.

mchandrasekaran · ‎10-08-2016

Hi @alemarzu, Thank you so much, but the part after the password reset did not work for me (that is the append part). However, I am thinking of using lookup table to save the account names and the dates on which they changed their password. Then search for account lockouts, and return those accounts which are not present in the lookup table. If the account is present in the lookup table, return if the date of password change is not before the date of account lockout. Do you think this is a feasible idea? or would it be better to take a different approach?

mchandrasekaran · ‎09-12-2016

Thank you MuS. Yes, I will take a look at that.

mchandrasekaran · ‎09-12-2016

Thank you sundareshr, but no it is not giving the result I am looking for. It is just filtering on events that have 627. Those users don't have the eventcode 4740.

mchandrasekaran · ‎09-12-2016

This is the search I am using : source=wineventlog:security "EventCode=627" OR "EventCode=4740" [|search source=wineventlog:security EventCode=4740 | fields user,_time] | search "EventCode=627" | table user,_time In case using a subsearch isn't the right way to do it, I am thinking of using lookup tables to do the task.

mchandrasekaran · ‎09-09-2016

Got it. Thank you so much.

mchandrasekaran · ‎09-09-2016

Yes, I am using user and lockout_time as a filter. I am able to pass it as _time, the problem arises when I use rename _time as lockout_time

mchandrasekaran · ‎09-09-2016

Hi, I am trying to pass the time from a subsearch to the main search. I used the rename function the way you have mentioned in the above comment, but it is not working. Any idea on what might be the issue? This is the subsearch that I am using : [|search source=wineventlog:security EventCode=4740 | rename _time as lockout_time | fields user,lockout_time] Thank you

mchandrasekaran · ‎09-08-2016

I am writing a query to find if a account got locked out because of an attack or because of an account change that happened in the last 7 days before the account got locked out. I am using subsearch and AD eventcodes to do this : the subsearch looks for the account that got locked out, passes the user and the time(_time). The second half filters the accounts which have had account changes. However, I am not able to add the clause to check if that password change happened seven days before the time at which the account got locked out. How do I add this? I tried the following : using earliest=_time - (3600*168) latest=_time at the end of the second search _time>-7d@d but both doesn't work. Can any of you think of a way to do this?

Posts	10
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎09-08-2016

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Add time clause on the second search of a subsearc...

Re: Add time clause on the second search of a subs...

Re: Add time clause on the second search of a subs...

Re: Add time clause on the second search of a subs...

Re: Add time clause on the second search of a subs...

Re: Add time clause on the second search of a subs...

Re: Add time clause on the second search of a subs...

Re: How to run different timerange in subsearch ve...

Re: How to run different timerange in subsearch ve...

Re: How to run different timerange in subsearch ve...

Add time clause on the second search of a subsearc...