Hey All, I need to detect inactive users in Active Directory using Elastic SIEM. Any ideas how can I do that using EQL? I implemented the detection login in Splunk by using lookup files where I write to a lookup file all domain users who generate 4624 events, then doing my another search based on t…

Transform will look something like this [image] And the results: [image]

Discuss the Elastic Stack

Detecting inactive users in Active Directory

Elastic Security SIEM

jamesspi (Jamesspi) January 25, 2023, 12:29am 7

Transform will look something like this

And the results:

3 Likes

Detect previous password change in bruteforce detection rule

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.