List of Source Names and Frequency of Events

The following splunk query will output a list of all SourceNames in a windows environment and include a sparkline to indicate frequency:

Continue Reading →

Gauge of Windows Failed Logons

Gauge of Windows Failed Logons. Adjust the gauge to meet your environments needs.

Continue Reading →

Gauge of Windows Successful Logons

Gauge of Windows Successful Logons. Adjust the gauge to meet your needs.

Continue Reading →

Search Common EventCodes (EventID’s) for Suspicious Behavior

This query searches many common EventCodes (EventID’s) within a Windows environment for suspicious behavior. The query can take some time to run due to it’s length. Excellent for high-level security insight.

Continue Reading →

Logon Types within a Windows Environment (with logon count)

This query will identify logon types within a windows environment and list the number of logons associated with each type.

Continue Reading →