Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About rodiers01
rodiers01
New Member
Member since:
02-15-2017
06-05-2020
Community Statistics
| Posts | 8 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 02-15-2017 |
Activity Feed
- Posted How can I find AD accounts that haven't been used for a specified time period? on Getting Data In. 09-08-2017 02:10 PM
- Tagged How can I find AD accounts that haven't been used for a specified time period? on Getting Data In. 09-08-2017 02:10 PM
- Tagged How can I find AD accounts that haven't been used for a specified time period? on Getting Data In. 09-08-2017 02:10 PM
- Posted Find out who changed an AD account password? on Splunk Dev. 07-26-2017 02:01 PM
- Tagged Find out who changed an AD account password? on Splunk Dev. 07-26-2017 02:01 PM
- Posted Is it possible to create an alert in Splunk Enterprise if a command is run in CMD? on Alerting. 05-18-2017 10:36 AM
- Tagged Is it possible to create an alert in Splunk Enterprise if a command is run in CMD? on Alerting. 05-18-2017 10:36 AM
- Tagged Is it possible to create an alert in Splunk Enterprise if a command is run in CMD? on Alerting. 05-18-2017 10:36 AM
- Tagged Is it possible to create an alert in Splunk Enterprise if a command is run in CMD? on Alerting. 05-18-2017 10:36 AM
- Tagged Is it possible to create an alert in Splunk Enterprise if a command is run in CMD? on Alerting. 05-18-2017 10:36 AM
- Posted How to generate a search that will show standard user accounts that escalate to administrator? on Splunk Search. 04-11-2017 09:44 AM
- Tagged How to generate a search that will show standard user accounts that escalate to administrator? on Splunk Search. 04-11-2017 09:44 AM
- Tagged How to generate a search that will show standard user accounts that escalate to administrator? on Splunk Search. 04-11-2017 09:44 AM
- Tagged How to generate a search that will show standard user accounts that escalate to administrator? on Splunk Search. 04-11-2017 09:44 AM
- Tagged How to generate a search that will show standard user accounts that escalate to administrator? on Splunk Search. 04-11-2017 09:44 AM
- Tagged How to generate a search that will show standard user accounts that escalate to administrator? on Splunk Search. 04-11-2017 09:44 AM
- Posted Re: How to generate a search to see which users have signed in from a different country other than the U.S. in the last 24 hours? on Splunk Search. 02-15-2017 01:48 PM
- Posted Re: How to generate a search to see which users have signed in from a different country other than the U.S. in the last 24 hours? on Splunk Search. 02-15-2017 01:18 PM
- Posted Re: How to generate a search to see which users have signed in from a different country other than the U.S. in the last 24 hours? on Splunk Search. 02-15-2017 01:03 PM
- Posted How to generate a search to see which users have signed in from a different country other than the U.S. in the last 24 hours? on Splunk Search. 02-15-2017 12:39 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
09-08-2017
02:10 PM
Query that can tell me non-disabled active directory accounts that have not been used in 12 or more weeks?
All in the title. I'm looking to run a query that can give me this data. Thanks all.
... View more
07-26-2017
02:01 PM
I found the pwsLastSet field which tells me when a password was actually reset but I'm trying to see who actually reset the password. Is that possible in either the MS Windows AD Objects app or the Splunk App for Windows Infrastructure?
... View more
- Tags:
- splunk-enterprise
05-18-2017
10:36 AM
Is it possible in Splunk Enterprise to create an alert if someone were to run a command in MS-DOS?
Specifically I'm looking to create an alert if this command below is run in CMD
auditpol /clear /y
This is something a malicious actor would do so that auditing is turned off on the machine and then they can go about their business.
Thanks for any input
... View more
04-11-2017
09:44 AM
Good afternoon all. After an attacker gathers the login credentials for a standard user account they will want to elevate those same credentials to become an administrator. I'm looking to see if there's a search that I can run which will look for something like that? I'd like to generate an e-mail alert.
I have the following set-up below...
Cisco Security Suite, IIS Logging, Splunk App for Web Analytics, MS Windows AD Objects, Splunk App for Windows Infrastructure, Splunk Support for Active Directory.
Thanks folks.
... View more
02-15-2017
01:48 PM
BINGO! Good call with that last query. That's exactly what I needed!
The help is top notch over here.
... View more
02-15-2017
01:18 PM
The query below that I'm trying isn't giving me any results either when I know It should be....
index="iis_log" cs_username !=OTHER | dedup c_ip | iplocation prefix=cip_ c_ip | search cip_Country !=United States
... View more
02-15-2017
01:03 PM
Cisco Security Suite, IIS Logging, Splunk App for Web Analytics, MS Windows AD Objects, Splunk App for Windows Infrastructure, Splunk Supporting Add-on for AD.
... View more
02-15-2017
12:39 PM
Good afternoon all
I'm just looking for a search that will search for anyone that has logged in to a web site, from a different Country (other than the U.S.), in the last 24 hours. Thank you.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
