I recently had an error message pop up synchronizing from our on-prem AD servers to Entra about an account issue.  I found that the account in question had all the attributes correct except for the userPrincipalName.  In the UPN, instead of having the username@mydomain.com, it was changed to a "\"@mydomain.com.  I am trying to figure out who or which account made that change in Splunk Cloud.  I have searched for Event IDs 4738 and it shows the UPN with the "\" but it doesn't tell me who made the change.  Also I am looking in the Windows TA addon to see if I can find any more info in there. ... View more

I am looking to build an alert that sends an email if someone locks themselves out of their Windows account after so many attempts.  I built a search out but when using real time I was bombarded with emails every few minutes which doesn't seem right.  I would to have the alert be setup such as if user x types the password in 3 times wrong and AD locks the account, send an email to y's email address.  Real time alerting seems to be what I would need but it bombards me way too much. ... View more

I am looking to write a simple search that tells me if a host or hosts are reaching out to a specific IP address.  So far I have  index="firewall" host=hostname src_addr=x.x.x.x dest_addr=x.x.x.x When I run this it doesn't come back with anything.  Should I be searching under my domain instead?  I would like for it to be lined up like below,   Hostname | source IP | destination IP ... View more

I am able to pull my AD users account information successfully except for their email addresses.  What am I doing wrong? Apologize since I am still learning.   | inputlookup AD_Obj_User WHERE domain="mydomain" | fields domain, sAMAccountName, userAccountControl, uac_details,domain, distinguishedName, mail, whenChanged,whenCreated | table domain, sAMAccountName, userAccountControl, uac_details,domain, distinguishedName, mail, whenChanged,whenCreated | eval uac_details=replace(mvjoin(uac_details,":"),"([\r\n]+)",":") | makemv delim=":" uac_details | search [| makeresults | eval uac_details=replace("#empty#,#empty#,#empty#,#empty#,#empty#,#empty#,#empty#,#empty#,#empty#,#empty#,#empty#,#empty#,#empty#,#empty#","#empty#","") | makemv delim="," uac_details | eval mfilt_uac=mvfilter(match(uac_details,"^\w+")) | eval search=if(isnull(mfilt_uac),"","uac_details=\"".mvjoin(mfilt_uac,"\" AND uac_details=\"")."\"") | table search] | sort 0 sAMAccountName | rename sAMAccountName AS "user", uac_details AS userAccountControl_Details ... View more

I wrote a simple query to parse my Windows Event Security logs to look for a user account, however I am looking to add onto this and find out which devices the accounts are running on. index="wineventlog" source="WinEventLog:Security" user="domainaccount" My end goal is to be able to type in a domain account in my search and find what device its associated with or is running as a service under.   ... View more