topic Re: Identify User Logged Out From Inactivity in Security

Identify User Logged Out From Inactivity

swsouth — Fri, 18 Jul 2014 16:25:08 GMT

Hi all, we are looking at Splunk as a potential source to identify users that have long periods of inactivity. If there is no formal "logged out" or "timed out" message to queue on in the logs, would there be some way to determine time between last activity and then after a specified period of inactivity, the user is considered "logged out by inactivity" and added to a report that will be sent daily? Is this within Splunk's capabilities? If so, would this require any special scripting beyond a complex search?

I know this is pretty vague and I don't have a lot of specifics yet, but just wanted to throw it out and get some initial feedback. I'll provide updates as things progress.

Thanks

Re: Identify User Logged Out From Inactivity

somesoni2 — Fri, 18 Jul 2014 17:06:57 GMT

This information is for Splunk itself (splunk web usage by users) or any other application whose data in indexed in splunk?

Re: Identify User Logged Out From Inactivity

strive — Fri, 18 Jul 2014 17:36:31 GMT

To add to what somesoni2 has asked for, if it is some other application's data indexed in splunk and if the log files contain the minimum required information then it is possible to generate the report that you are asking for. Whether a script is required or a splunk search is sufficient depends on the data granularity present in log events.

Re: Identify User Logged Out From Inactivity

swsouth — Fri, 18 Jul 2014 21:00:36 GMT

Somesoni2, this is for another application, not Splunk. Strive, the data is supposed to be provided from the WebSEAL logs (specifically, request.log). They initially identified userid, IP, log in/out time, last activity time as the required info.

Re: Identify User Logged Out From Inactivity

dwaddle — Sun, 20 Jul 2014 14:16:37 GMT

You can get close to this with some heuristics and use of the transaction command - specifically through the use of maxpause. The theory is that when a user is active, the result of that activity creates log entries. But, if they stop being active for the application's idle timeout (which you have to know), then they have in effect "logged out by inactivity".

The "logout time" can be loosely defined as "the last event + idle timeout"

So, a search something like:

sourcetype=webseal source=*/request.log 
| transaction maxpause=30m userid
| eval logout_time=_time + duration + (30 * 60)
| table userid, logout_time

would at least get you in the neighborhood.