topic Re: Search to find unauthorized host(s) last login date in Splunk Search

Search to find unauthorized host(s) last login date

cjsweeney1 — Wed, 22 Mar 2017 12:45:24 GMT

Hi looking for a search to find any unauthorized systems that are sitting on a network and the last login date.

Re: Search to find unauthorized host(s) last login date

richgalloway — Wed, 22 Mar 2017 14:02:52 GMT

To find unauthorized systems you'll first need a list of the authorized systems, perhaps in a lookup file. Then search to find ALL systems on your network and compare that list to the authorized list. The difference is the unauthorized systems.

Re: Search to find unauthorized host(s) last login date

cjsweeney1 — Wed, 22 Mar 2017 14:39:00 GMT

Hmmm.... could work. Could that lookup file be automatically updated? I was hoping enterprise security would have a report like this built-in.

Re: Search to find unauthorized host(s) last login date

cjsweeney1 — Wed, 22 Mar 2017 14:56:25 GMT

Hey Rich,

You know a search string to find a particular hosts last ip "pull" is... I'm wondering if the last time it had a DHCP timestamp assigned is all I will be able to get.

Re: Search to find unauthorized host(s) last login date

richgalloway — Wed, 22 Mar 2017 21:28:00 GMT

Yes, it's possible to automatically update the lookup file.

Re: Search to find unauthorized host(s) last login date

richgalloway — Wed, 22 Mar 2017 21:28:20 GMT

I don't know that.