https://community.splunk.com/t5/Alerting/Can-you-help-me-create-a-service-account-log-in-alert/m-p/404419#M11203 <P>Hello all, I have a service account (Account_AB) that should only log into a particular server (Server_A). We are getting AD logs into our Splunk instance. How would I go about setting an alert to notify if Account_AB logs into any other device other than Server_A? Thanks in advance.</P> Tue, 29 Sep 2020 21:28:37 GMT mekkac11 2020-09-29T21:28:37Z https://community.splunk.com/t5/Alerting/Can-you-help-me-create-a-service-account-log-in-alert/m-p/404419#M11203 <P>Hello all, I have a service account (Account_AB) that should only log into a particular server (Server_A). We are getting AD logs into our Splunk instance. How would I go about setting an alert to notify if Account_AB logs into any other device other than Server_A? Thanks in advance.</P> Tue, 29 Sep 2020 21:28:37 GMT https://community.splunk.com/t5/Alerting/Can-you-help-me-create-a-service-account-log-in-alert/m-p/404419#M11203 mekkac11 2020-09-29T21:28:37Z https://community.splunk.com/t5/Alerting/Can-you-help-me-create-a-service-account-log-in-alert/m-p/404420#M11204 <P>First, you need to find out which fields are relevant for your search. Search for logins by Account_AB in Splunk and have a look at the available fields. Relevant fields might be EventCode, Account_Name, Workstation_Name...</P> <P>If you are using the Windows Add-on then there should be standardized CIM fields available like tag, user and src.</P> <P>Now create a search to find login events by Account_AB from systems other than Server_A:</P> <PRE><CODE>index=* source="WinEventLog:Security" tag=authentication action=success user="Account_AB" src!="Server_A" </CODE></PRE> <P>Now save this search as an alert and have the trigger condition "Number of Results is greater than 0".</P> Tue, 29 Sep 2020 22:18:06 GMT https://community.splunk.com/t5/Alerting/Can-you-help-me-create-a-service-account-log-in-alert/m-p/404420#M11204 whrg 2020-09-29T22:18:06Z