topic Re: Identies question in Splunk Enterprise Security

Identies question

Niro — Tue, 07 Nov 2023 05:33:18 GMT

Hello,

I've set up an identity lookup using ldapsearch - it creates an identity of "username" that contains various details about the user, including the email address. It works well in identifying the user as `username` and `useremail@domain'.

However I'd like to also have it identify users based on `domain\username` and `username@domain' (which is actually different than `useremail` in our case) since a lot of our logs contain the user field in those formats. What's the best way to do that?

Re: Identies question

isoutamo — Tue, 07 Nov 2023 08:32:31 GMT

There is two options to get those into your lookup.

Get those from you ldap query. This is obviously the best option as then those are absolutely correct. Unfortunately I haven't any suitable AD to look what fields those are and how you could get those. I'm quite trustful that those are there. Just ask from your AD admins and they probably help you.
If you have standard how those are created based on other attributes then just regenerate those before you add entry to lookup.

r. Ismo

Re: Identies question

Niro — Tue, 07 Nov 2023 13:06:18 GMT

Thanks for your reply!

I guess I should clarify my question though - I can figure out how to generate them, the question is where do I put them? Do I create additional fields in the lookup for the user and somehow splunk will use that field? Make the identify field a multivalue field?

Re: Identies question

isoutamo — Tue, 07 Nov 2023 20:49:57 GMT

Probably the easiest way is just add a new fields into the end of your lookup file lines. That way it's easier to use those than use e.g. mvfields.

Re: Identies question

Niro — Tue, 07 Nov 2023 21:40:37 GMT

Thanks!

I did that, but how do I make it use the new field as an identity? IE right now I have the "identity" field which is the samaccountname, and I also see it merged the email address into it when looking at the identity center. However if I add another field (ie domain_identity) it won't use it for identity lookups as far as I can tell. What I did for now (which might be completely the wrong way to do it) is create another identity lookup with the exact same query as the first one (which gets all fields from active directory) but for "identity" I'm adding `domain\username`. That seems to do the trick since it merges identities based on email address (which matches).

I'm sure I'm missing something very basic here though.

Re: Identies question

isoutamo — Tue, 07 Nov 2023 21:59:29 GMT

Have you try to use index_field_list on transforms.conf for CSV based lookup and/or accelerated_fields on collections.conf for kvstore based lookup?