topic Re: authentication method in a query on splunk in Security

authentication method in a query on splunk

rsaude — Wed, 05 Feb 2020 15:13:59 GMT

Hey everyone,

Is there a way to check for which kind of authentication method is being used by splunk in a log? (Splunk itself, SAML or LDAP)

Thanks in advanced

Re: authentication method in a query on splunk

harsmarvania57 — Wed, 05 Feb 2020 16:09:47 GMT

As far as I know that in splunk logs those information are not available.

Re: authentication method in a query on splunk

rsaude — Wed, 05 Feb 2020 16:11:50 GMT

i feard that, in any case if anyone knows a work around feel free to share please

Re: authentication method in a query on splunk

harsmarvania57 — Wed, 05 Feb 2020 16:26:43 GMT

Try below search (It is ugly because of join) but I think it will give you a result.

index=_audit host=<your host> action="login attempt"
| fields user, action, info, src 
| join type=left user
    [| rest /services/authentication/users splunk_server=local f=title f=type 
    | rename title as user 
    | fields user, type ]
| table user, type, action, info, src

Re: authentication method in a query on splunk

rsaude — Wed, 05 Feb 2020 16:30:47 GMT

it did not work for me, there were users that appeared with no type (Probably because they no longer exist)

Re: authentication method in a query on splunk

rsaude — Wed, 05 Feb 2020 16:33:02 GMT

I managed to get it working for me, but thank you for your help anyway

Re: authentication method in a query on splunk

rsaude — Wed, 05 Feb 2020 16:33:43 GMT

With the app https://splunkbase.splunk.com/app/1866/
i was able to get one of the dashboards which displayed what i wanted,

Name: Users by authentication type
Code: | rest splunk_server=local /services/authentication/users | stats count by type

Re: authentication method in a query on splunk

rsaude — Wed, 05 Feb 2020 16:34:56 GMT

It's not 100% correct since it wasn't in a log but since i got it to work i'll call it a win.

Re: authentication method in a query on splunk

harsmarvania57 — Wed, 05 Feb 2020 16:38:13 GMT

Yes, query which I have provided will give you type if that user exist in splunk, it it does not exist then it will give you blank.

Re: authentication method in a query on splunk

harsmarvania57 — Wed, 05 Feb 2020 16:38:36 GMT

Welcome... 🙂