topic Re: Identifying events that originate greater than 50 miles from a lon\lat. in Splunk Enterprise Security

Identifying events that originate greater than 50 miles from a lon\lat.

bbraun — Mon, 29 Apr 2019 18:46:16 GMT

Hello,

We have multiple international locations (Japan, Italy, Spain ect...) and are looking to identify events that occur outside a 50 mile radius from each location using their latitude and longitude. The end goal is to set different thresholds for these sites. Id imagine ill need to create a lookup for each locations latitude and longitude for the query to reference.

I'm not exactly sure where to begin and hope you guys can point me in the right direction.

Re: Identifying events that originate greater than 50 miles from a lon\lat.

lakshman239 — Mon, 29 Apr 2019 20:26:43 GMT

Have you looked access anomalies dashboard which is available as part of user activity monitoring? Geographically Improbable Accesses - https://docs.splunk.com/Documentation/ES/5.3.0/User/UserRisk#Access_Anomalies

Re: Identifying events that originate greater than 50 miles from a lon\lat.

bbraun — Mon, 29 Apr 2019 20:51:15 GMT

yea, I figured I could steal logic from the Correlation Search as a plan B. I was hoping someone had already tackled this issue since I dont have a lot of experience building queries.

Re: Identifying events that originate greater than 50 miles from a lon\lat.

adonio — Tue, 30 Apr 2019 00:00:03 GMT

couple of accepted answers in this portal that leads to this blog:
http://www.sedward5.com/detecting-credential-theft-using-splunk-geographic-information/

here are the answers:
https://answers.splunk.com/answers/219607/how-to-search-concurrent-logins-from-geographicall.html
https://answers.splunk.com/answers/169873/how-to-set-up-an-alert-to-detect-login-abuse-and-c.html

hope it helps