Hey ya'll - I am attempting to create an efficient search to detect password compromises within some environments, the map command is very intensive and clicking to pass tokens is not automated, I was wondering if there are other solutions. Below I have 2 macros, 1 which will detect failed logons based on the account_name field greater than 13. The second will pull all of the successful logins from a keyboard. Using a saved-search would also be acceptable. My goal is to have a result from these two macros that will provide the host name where the compromise occurred, the time when the initial password compromise occurred, and which user, if any, within 120 seconds successfully logged onto that same machine where the compromise occurred.  This seems to be a simple solution but cant seem to put two and two together. Appreciate the support!!! Macro 1 - password_compromise   index=wineventlog source="wineventlog:security" "logname=security" (EventCode=4625 Logon_Type=2) | eval newtime=_time+120 | eval oldtime=_time | eval Account_Name = mvfilter(Account_Name!="-" AND NOT match(Account_Name,"\$$")) | eval number=len(Account_Name) | eval status=case(number>13,"Potential Password Compromise", number<=9,"OK") | where status="Potential Password Compromise" | rename Account_Name as "Potential Password?" | sort -_time | table _time host "Potential Password?" oldtime newtime status | outputcsv passwordcompromise_initial.csv   Macro 2 - password_logon   index=wineventlog source="wineventlog:security" "logname=security" (EventCode=4624 LogonType=2) | eval AccountName = mvfilter(NOT match(AccountName, "-") AND NOT match(AccountName, "DWM*") AND NOT match(AccountName,"\$$$$")) | eval logontime=time | dedup host, AccountName, logontime | where AccountName!="" | rename AccountName as "AuthenticatedUser" | table time host "AuthenticatedUser" logontime | outputcsv password_successfullogon.csv     ... View more

Hey Ya'll - Wanted to see if anyone has a simplified solution for locating potential password compromises in a Windows AD Environment. For example, in an Active Directory domain structure, when a user accidentally types their password in the username field and presses enter, the information is sent to the security log. The user will then see they failed their logon and then attempt to logon in again. The following SPL is what I can use to pull the events but is not the best method. I have a manual method where I can pass a token from 1 panel to another but would like an automated method. index=wineventlog source="wineventlog:security" EventCode=4625 OR (EventCode=4624 Logon_Type=2) |  eval Account = mvindex(Account_Name,1)  <- the default pulls the computer name, using 1 for user name | transaction maxspan=1m startswith="EventCode=4625"  endswith="EventCode=4624" | table _time host EventCode Account * From the SPL above I would like to have the multivalue Account field from the table require no null fields for the Account name (1 field will be the compromised password, and the other will be the user name, sometimes no name will show with the 4625 event) and also require one of the multivalue account fields length be greater than 13 ... View more

Windows does not provide an accurate user who performed an audit policy change on the system (EventCode 4719), it lists System versus the logged in user. I would like to identify EventCode=4719 as the primary event and then search for the closest EventCode=4624 prior to when EventCode=4719 occurred.   I have been checking the splunk community page and google to look for something that meets the need. I cannot seem to grasp this concept and would appreciate the help!     ... View more