https://community.splunk.com/t5/Splunk-Search/How-to-try-to-search-for-new-MFA-factors-with-DUO/m-p/605902#M210699 <P>Pro tip:</P><OL><LI>Illustrate the data you re trying to search (sanitize as necessary). &nbsp;This is a Splunk board. &nbsp;Most people will not know what your DUO data look like. &nbsp;</LI><LI>Illustrate attempted code you have made so far to improve others' understanding of your intentions.</LI></OL> Sun, 17 Jul 2022 23:21:54 GMT yuanliu 2022-07-17T23:21:54Z https://community.splunk.com/t5/Splunk-Search/How-to-try-to-search-for-new-MFA-factors-with-DUO/m-p/605646#M210620 <P>I'm trying to find any new MFA factors(DUO) used by any user in the past X days in order to create an alert.&nbsp; As an example a user uses push notifications every login for X-1 days then on the X day they use passcode, I want to trigger an alert or show up in a report.</P> <P>&nbsp;</P> <P>I'm having an issue wrapping my head around on how to search for the first instance of a new value for the field factor in the past X days without specifying the expected value ahead of time (some users use push, some use phone call, some use pass code I just want to know when they use something different.&nbsp; Any assistance or tips would be helpful.</P> Thu, 14 Jul 2022 16:55:51 GMT https://community.splunk.com/t5/Splunk-Search/How-to-try-to-search-for-new-MFA-factors-with-DUO/m-p/605646#M210620 JR_Akaviri 2022-07-14T16:55:51Z https://community.splunk.com/t5/Splunk-Search/How-to-try-to-search-for-new-MFA-factors-with-DUO/m-p/605902#M210699 <P>Pro tip:</P><OL><LI>Illustrate the data you re trying to search (sanitize as necessary). &nbsp;This is a Splunk board. &nbsp;Most people will not know what your DUO data look like. &nbsp;</LI><LI>Illustrate attempted code you have made so far to improve others' understanding of your intentions.</LI></OL> Sun, 17 Jul 2022 23:21:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-try-to-search-for-new-MFA-factors-with-DUO/m-p/605902#M210699 yuanliu 2022-07-17T23:21:54Z