Splunk Enterprise Security

How to find LDAP accounts that have been disabled for longer then 30 days

gthomas719
New Member

Hi everyone.
I'm new to Splunk and trying to work on a search that would return accounts in LDAP that have already been disabled for 30 days or longer. I have found that the event code for disabled accounts is 4725, and I can see accounts that have been set to disable within the last 30/60/90... days, but not sure how to see ones that have been sitting in disabled status for 30 days or longer

Any assistance is MUCH appreciated!

0 Karma

damiensurat
Contributor

so you can use the timestamp from the event data and then calculate in seconds the diff between now and the date of the event
timestamp. this can be used to generate a new field which will give you the offset in time in days:

your splunk search
| eval now = now()
| eval secDiff = (now - _time)
| eval ageOfLastEventInDays = round(secDiff/86400,2)
| search ageOfLastEventInDays >= 30

0 Karma

gthomas719
New Member

So would the search look like this:

index="wineventlog" EventCode=4725
| eval now = now()
| eval secDiff = (now - _time)
| eval ageOfLastEventInDays = round(secDiff/86400,2)
| search ageOfLastEventInDays >= 30

0 Karma

Prakash493
Communicator

Their is a way to determine if any users has not been logged to splunk from last 30 days but if you are looking for ldap disabled accounts , if its indexed then you can get it.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...