topic Using Splunk to identify SSO users that use NTLM in Security https://community.splunk.com/t5/Security/Using-Splunk-to-identify-SSO-users-that-use-NTLM/m-p/482846#M11116 <P>Does anyone have some SPL they could share that identifies SSO users that use NTLM to authenticate? Any help with this is greatly appreciated.</P> Tue, 25 Feb 2020 20:04:00 GMT itsmevic 2020-02-25T20:04:00Z Using Splunk to identify SSO users that use NTLM https://community.splunk.com/t5/Security/Using-Splunk-to-identify-SSO-users-that-use-NTLM/m-p/482846#M11116 <P>Does anyone have some SPL they could share that identifies SSO users that use NTLM to authenticate? Any help with this is greatly appreciated.</P> Tue, 25 Feb 2020 20:04:00 GMT https://community.splunk.com/t5/Security/Using-Splunk-to-identify-SSO-users-that-use-NTLM/m-p/482846#M11116 itsmevic 2020-02-25T20:04:00Z Re: Using Splunk to identify SSO users that use NTLM https://community.splunk.com/t5/Security/Using-Splunk-to-identify-SSO-users-that-use-NTLM/m-p/482847#M11117 <P>Was able to figure this out by pulling a consistent text string produced in the SSO logs and then filtering my SPL around that. </P> Tue, 03 Mar 2020 01:55:15 GMT https://community.splunk.com/t5/Security/Using-Splunk-to-identify-SSO-users-that-use-NTLM/m-p/482847#M11117 itsmevic 2020-03-03T01:55:15Z