topic Dashboard for Successfully Login in Linux and Windows in Dashboards & Visualizations

Dashboard for Successfully Login in Linux and Windows

shubhajits — Thu, 10 Sep 2020 15:53:17 GMT

Hi Splunk Community

I am completely new on splunk. I somehow managed to deploy the splunk Universal Forwarder on many linux nodes and few windows systems.

I am able to view the /var/log/secure and /var/log/message that are getting indexed and the windows security event log on the created index.

I want a dashboard that shows information of the below :-

1. Number of Hosts where splunk forwarder is deployed (linux and windows separate).

2. Successfull and failed login.

3. Alert when root is logged in linux and Administrator login in windows.

Re: Dashboard for Successfully Login in Linux and Windows

lakshman239 — Thu, 10 Sep 2020 16:11:15 GMT

For dashboards, you would need to create the search matching your need and save it as a view. I would also suggest you completing https://www.splunk.com/en_us/training/free-courses/splunk-fundamentals-1.html and looking at Splunk dashboards example app and Splunk unix app in splunk base - https://splunkbase.splunk.com/app/273/

Re: Dashboard for Successfully Login in Linux and Windows

gcusello — Thu, 10 Sep 2020 16:14:40 GMT

Hi @shubhajits,

you're asking many easy things:

to have the list of servers that are sending logs, you could run something like this:

| metasearch index=os or index=wineventlog | stats count BY index

but in this case you have only the servers that are sending logs, if a server is missing you haven't it, but this is another question that you can search in Community.

For successul or unsuccessful logins there's a problem, that every windows login generates around 10-12 login events (EventCode=4624) so the results could be non reliable.

Anyway, the search could be (for windows) something like this:

index=wineventlog EventCode=4624 OR EventCode=4625 | stats count BY EventCode

and for Linux, something like this:

search = index=os sourcetype=linux_secure NOT disconnect ("accepted password" OR "failed password") | eval action=if(searchmatch("accepted password"),"Login","LogFail") | stats count BY action

If you want all in one panel it's just a little bit complicate because you should create four eventtypes:

windows_login (index=wineventlog EventCode=4624)
windows_logfail (index=wineventlog EventCode=4625)
linux_login (index=os "accepted password")
linux_logfail (index=os "failed password")

using the above searches and associating to eventtypes LOGIN or LOGOUT tags, then you can run a simple search using tags:

tag=LOGIN OR tag=LOGFAIL | stats count BY index tag

About the alert for root or administrator, you have to search for the eventtypes windows_login or linux_login and the words root or administrator, something like this:

tag=LOGIN (root OR administrator)

Only one final hint: follow the Search Tutorial to understand SPL.

Ciao.

Giuseppe