SPL
Active Directory Password change attempts
Description
Use the following search to create a stacked barchart of AD Password change attempts:
3 0
source="WinEventLog:Security" "EventCode=4723" src_user!="*$" src_user!="_svc_*" | eval daynumber=strftime(_time,"%Y-%m-%d") | chart count by daynumber, status | eval daynumber = mvindex(split(daynumber,"-"),2)
Comments
0 total
Be the first to comment on this SPL.
Leave a comment
You must log in to post a comment.