Active Directory Account lockout and unlocks

id: 9f384f37-ff17-446d-b49a-40c6fb98b1ba
name: Active Directory Account lockout and unlocks
description: |
  This query lists Active Directory accounts lockout and unlock events
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - IdentityDirectoryEvents
tactics:
- Initial Access
relevantTechniques: []
query: |
    IdentityDirectoryEvents
    | where ActionType == 'Account Unlock changed'
    | extend AccountLockStatus = iif(tobool(parse_json(AdditionalFields)['TO Account Unlock']), 'Locked', 'Unlocked')
version: 1.0.0
metadata:
    source:
        kind: Community
    author:
        name: Martin Schvartzman
    support:
        tier: Community
    categories:
        domains: [ "Security - Identity" ]