admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Updated search strings from "lockout"

Browse Source 
to "*locked out*" to reflect the string
that actually appears in the logs.  Also,
removed the nodename from the seach
since it was not required.
This commit is contained in:
pyth0n1c
2022-07-28 17:17:21 -07:00
committed by GitHub
parent b622c65def
commit 3dfd3c6ed6
2 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml
+2 -2
View File
@@ -10,8 +10,8 @@ description: This search identifies endpoints that have caused a relatively high
of account lockouts in a short period.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime values(All_Changes.user) as user from datamodel=Change.All_Changes where
nodename=All_Changes.Account_Management All_Changes.result="lockout" by All_Changes.dest
All_Changes.result |`drop_dm_object_name("All_Changes")` |`drop_dm_object_name("Account_Management")`|
All_Changes.result="*locked out*" by All_Changes.dest All_Changes.result
|`drop_dm_object_name("All_Changes")` |`drop_dm_object_name("Account_Management")`|
`security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | search
count > 5 | `detect_excessive_account_lockouts_from_endpoint_filter`'
how_to_implement: "You must ingest your Windows security event logs in the `Change`\
detections/endpoint/detect_excessive_user_account_lockouts.yml
+2 -2
View File
@@ -9,8 +9,8 @@ datamodel:
description: This search detects user accounts that have been locked out a relatively
high number of times in a short period.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Change.All_Changes where nodename=All_Changes.Account_Management
All_Changes.result="lockout" by All_Changes.user All_Changes.result |`drop_dm_object_name("All_Changes")`
as lastTime from datamodel=Change.All_Changes where All_Changes.result="*locked out*"
by All_Changes.user All_Changes.result |`drop_dm_object_name("All_Changes")`
|`drop_dm_object_name("Account_Management")`| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | search count > 5 | `detect_excessive_user_account_lockouts_filter`'
how_to_implement: ou must ingest your Windows security event logs in the `Change`