Fellow Splunkers,
I am working on a query to monitor our Active Directory logins, and I want to watch for users logging into multiple machines within 15 minutes as an example to watch for things like shared credentials amongst staff or the account that has been compromised. The current search I have is below, but it isn't quite right.
index=wineventlog earliest=-4h | timechart span=15m dc(Client_Address) AS client_address_count by user
... View more
I need to perform a security audit on a particular user.
I need to enter in specific username = example mydomain\jimbob
I need to show logon \ logoff results
I need to show times of logon \ logoff
I need to show pc name - I assume this is source_network_address?
I need to show IP address of pc
I need to be specific on date range as well such as 08-13-2018 to 08-17-2018
... View more