topic CIM Authentication data model in Splunk Search

CIM Authentication data model

splunkreal — Sat, 02 Mar 2024 09:46:58 GMT

Hello,

I would like to know the aim of this default constraint :

(`cim_Authentication_indexes`) tag=authentication NOT (action=success user=*$)

action="success"

Especially what does it try to match with user=*$ ? User accounts ending with $ symbol like in Windows?

Thanks.

Re: CIM Authentication data model

gcusello — Sat, 02 Mar 2024 11:43:50 GMT

Hi @splunkreal,

user names ending with $ are windows service accounts and usually they aren't relevant in authentication monitoring.

Ciao.

Giuseppe

Re: CIM Authentication data model

PickleRick — Sat, 02 Mar 2024 13:42:10 GMT

As far as I remember, there are two kinds of account that have names ending with $ (in Windows - for other systems it's highly unlikely that there will be an account named this way; but it would be nice to account for that) - Managed Service Accounts (which @gcusello already mentioned) and computer accounts. Both of those account types are authenticated without using interactive authentication modes so they're irrelevant to the events you're looking for in this dataset.