Skip to content

Instantly share code, notes, and snippets.

@faststeak

faststeak/gist:f86839f54b8cd6b0423773b7960f6cf8

Created November 3, 2017 19:45
Show Gist options
  • Save faststeak/f86839f54b8cd6b0423773b7960f6cf8 to your computer and use it in GitHub Desktop.
Save faststeak/f86839f54b8cd6b0423773b7960f6cf8 to your computer and use it in GitHub Desktop.
Download ZIP
Splunk search for deleted systems from Active Directory data
Raw
gistfile1.txt
index=msad earliest=-1y sourcetype=activedirectory Computer
| makemv delim="|" objectClass
| search objectClass=computer
| makemv delim="|" memberOf
| makemv delim="|" servicePrincipalName
| stats last(objectClass) as objectClass last(distinguishedName) as distinguishedName last(sAMAccountName) as sAMAccountName last(cn) as cn last(userAccountControl) as userAccountControl last(isDisabled) as isDisabled last(isDeleted) as isDeleted last(whenChanged) as whenChanged last(whenCreated) as whenCreated last(dNSHostName) as dNSHostName last(operatingSystem) as operatingSystem by objectSid
| search isDeleted=True
| eval nt_host=if(like(operatingSystem,"Windows%"), (upper(substr(sAMAccountName, 1, len(sAMAccountName)-1))), null)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment