https://community.splunk.com/t5/Splunk-Enterprise-Security/check-traffic-RDP-connections/m-p/582558#M10573 <P>Hello</P><P>I have windows security logs on host. I remember when I just started with Splunk and I had my Splunk lab and I had some kind of security free add on ( can't remember) where I was able to see attempts on port&nbsp;<SPAN>3389 (dashboard)</SPAN></P><P>&nbsp;</P> Wed, 26 Jan 2022 15:16:08 GMT Pablo00 2022-01-26T15:16:08Z https://community.splunk.com/t5/Splunk-Enterprise-Security/check-traffic-RDP-connections/m-p/582392#M10567 <P>Hello<BR /><BR />any ideas how can i check rdp attempts or connections in Splunk? many thanks</P><P>&nbsp;</P> Tue, 25 Jan 2022 13:17:49 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/check-traffic-RDP-connections/m-p/582392#M10567 Pablo00 2022-01-25T13:17:49Z https://community.splunk.com/t5/Splunk-Enterprise-Security/check-traffic-RDP-connections/m-p/582466#M10571 <P>Are you collecting windows security logs from both the src and dest host?&nbsp;</P> Wed, 26 Jan 2022 03:03:04 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/check-traffic-RDP-connections/m-p/582466#M10571 johnhuang 2022-01-26T03:03:04Z https://community.splunk.com/t5/Splunk-Enterprise-Security/check-traffic-RDP-connections/m-p/582558#M10573 <P>Hello</P><P>I have windows security logs on host. I remember when I just started with Splunk and I had my Splunk lab and I had some kind of security free add on ( can't remember) where I was able to see attempts on port&nbsp;<SPAN>3389 (dashboard)</SPAN></P><P>&nbsp;</P> Wed, 26 Jan 2022 15:16:08 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/check-traffic-RDP-connections/m-p/582558#M10573 Pablo00 2022-01-26T15:16:08Z