SPL
Number of Accounts Created in a Windows Environment
Description
Account Creation Gauge used to indicate number of accounts created in a Windows environment. EventCodes (EventID's) used are for server 2003/XP and newer. Modify the gauge to fit your environment's needs.
2 2
sourcetype=WinEventLog:Security (EventCode=624 OR EventCode=4720) | eval NewAccount=case(EventCode=624, "New Account Created", EventCode=4720, "New Account Created") | stats count(NewAccount) as creation | gauge creation 1 5 15 25
Comments
0 total
Be the first to comment on this SPL.
Leave a comment
You must log in to post a comment.