Hey All, I need to detect inactive users in Active Directory using Elastic SIEM. Any ideas how can I do that using EQL? I implemented the detection login in Splunk by using lookup files where I write to a lookup file all domain users who generate 4624 events, then doing my another search based on t…

Transform will look something like this [image] And the results: [image]

Discuss the Elastic Stack

Detecting inactive users in Active Directory

Elastic Security SIEM

jamesspi (Jamesspi) January 25, 2023, 12:29am 7

Transform will look something like this

And the results:

3 Likes

Detect previous password change in bruteforce detection rule

Topic		Replies	Views
Alert when Log Source last event received is < 24 Hours Elastic Security	2	391	October 7, 2023
Analysing active directory users and computers Elasticsearch	1	358	November 11, 2020
Finding inactive users from event logs Elasticsearch	1	661	July 5, 2017
Can you query AD with Elastic to see Last Logon time? Elasticsearch	2	311	March 22, 2023
Detecting Active Directory Activity Beats winlogbeat	3	34	July 20, 2024

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Detecting inactive users in Active Directory

Related topics