Was hoping someone could give me some assistance with finding changes to audit mechanisms or changes to audit/data logs. Basically I'm trying to find out if someone has changed auditing policy or logs to try to hide nefarious activities from being captured in both Linux and Windows. I know Windows has EventCodes such as 4715, 4719, 4908, and 4912 that are audited, even if audit is changed or turned off, but am I missing something else, and what is the best way to try to find it in Linux? ... View more

Hi everyone. I'm new to Splunk and trying to work on a search that would return accounts in LDAP that have already been disabled for 30 days or longer. I have found that the event code for disabled accounts is 4725, and I can see accounts that have been set to disable within the last 30/60/90... days, but not sure how to see ones that have been sitting in disabled status for 30 days or longer Any assistance is MUCH appreciated! ... View more