topic Re: cloud login alert in Alerting

cloud login alert

LS — Sun, 29 Jul 2018 08:15:35 GMT

Hello all,

I'm kinda new to SIEMs and I'm trying to create an alert/rule that will notify me when a machine makes a cloud transaction, e.g. file transfer, or even a dropbox login. no success so far. my current query is:

sourcetype=WinEventLog:Security (EventCode=630) | eval status=case(EventCode=630, "Dropbox Sign in") |transaction user startswith=status="Dropbox" endswith=status="Successfully" maxevents=1 | where duration < 10

any help? Thanks in advance!

Re: cloud login alert

adonio — Mon, 30 Jul 2018 00:07:35 GMT

hello there,
i am not sure whether the search you provided can assist you with your use case.
windows event code 630 is about user account deleted. read here for full description:
https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=630
there are other ways to capture file transfer from the OS level logs, but if Dropbox is the case (or other SaaS that has pre-built integrations with splunk) why not use the pre-built app and | or TA
in this case: https://splunkbase.splunk.com/app/2755/
bring the dropbox data in and see the wonders and power of splunk.

Re: cloud login alert

LS — Mon, 30 Jul 2018 04:45:04 GMT

Sir Adonio,

first of all, thank you very much for your answer! you are correct, I must say, but im looking for ways to create a rule for suspicious logins. There should be a way to include let's say X sites (azure,dropbox, wetransfer etc) and declare if "domain name contains "dropbox/azure/wetransfer". then alert me. Please pardon me for my english, but my actual objective is to create a rule. I'll still consider your suggestions though!