https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-alert-when-a-rogue-unknown-device-is-plugged-into-network/m-p/498635#M8708 <P>Hi, this is a bit generic question. One thing that i would do is <BR /> 1) Identify to which index is the network logs going <BR /> 2) Whitelist all known devices into a lookup file <BR /> 3) create an alert using a search which compares the host names and alert if it sees any new device.<BR /> If you have some sample events i can help with search, also look in Splunk base if you can find a related app which can do this for you.</P> Mon, 07 Oct 2019 20:37:12 GMT pruthvikrishnap 2019-10-07T20:37:12Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-alert-when-a-rogue-unknown-device-is-plugged-into-network/m-p/498634#M8707 <P>Hi,</P> <P>I need to be alerted when a rogue/unknown device is plugged into network. <BR /> Any help will be appreciated.</P> Mon, 07 Oct 2019 16:31:01 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-alert-when-a-rogue-unknown-device-is-plugged-into-network/m-p/498634#M8707 pradeep577 2019-10-07T16:31:01Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-alert-when-a-rogue-unknown-device-is-plugged-into-network/m-p/498635#M8708 <P>Hi, this is a bit generic question. One thing that i would do is <BR /> 1) Identify to which index is the network logs going <BR /> 2) Whitelist all known devices into a lookup file <BR /> 3) create an alert using a search which compares the host names and alert if it sees any new device.<BR /> If you have some sample events i can help with search, also look in Splunk base if you can find a related app which can do this for you.</P> Mon, 07 Oct 2019 20:37:12 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-alert-when-a-rogue-unknown-device-is-plugged-into-network/m-p/498635#M8708 pruthvikrishnap 2019-10-07T20:37:12Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-alert-when-a-rogue-unknown-device-is-plugged-into-network/m-p/498636#M8709 <P>Thank you for your kind response...yes its generic question.</P> <P>Would it be best to have CMDB( config. management DB) pulled into SIEM &amp; run the search against it.</P> Tue, 08 Oct 2019 11:59:04 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-alert-when-a-rogue-unknown-device-is-plugged-into-network/m-p/498636#M8709 pradeep577 2019-10-08T11:59:04Z