Retrieve user creation/deletion and password reset events from the sophos_windows_events table

This query retrieves account creation, deletion and password reset events under Windows. 

You can specify the number of days you want to go back, which is specified in the variable Days (string).

SELECT
   datetime(swe.time,'unixepoch') Date_Time,
   json_extract(swe.data, '$.EventData.TargetUserName') AS User_Name,
   CASE swe.eventid
      WHEN '4720' THEN 'Created'
      WHEN '4724' THEN 'Passwort Reset'
      WHEN '4726' THEN 'Deleted'
   END 'Action',
   json_extract(swe.data, '$.EventData.SubjectUserName') AS By,
   swe.data AS Details
FROM sophos_windows_events swe
WHERE eventid IN ('4720','4724','4726') AND time >= strftime('%s','now','-$$Days$$ days')