Alerting

How to create an alert to trigger when admins make a connection to a server not from their own IPs?

kalianov
Path Finder

Hi

I want to monitor admins by triggering an alert when an admin makes a connection to servers not from their own IPs. How I can do that? The question is, how to create an independent whitelist of IPs for each admin (not in search string) and match it with the logs?

I would be grateful for your ideas.

0 Karma
1 Solution

Jeremiah
Motivator

It depends on how frequently this IP list will change. You could manage the list of IP addresses in a lookup file (ie, a CSV) or you could have a scripted lookup that pulls the address list from an external source.

http://docs.splunk.com/Documentation/Splunk/6.3.3/SearchReference/Lookup

If you were using a lookup file, you'd probable have it formatted something like this, in a file called admin_ip.csv:

admin, allowed_ip
joe, 1.2.3.4
bob, 2.3.4.5

Then use a subsearch to look for your admin's activity. Substitute eventtype=login for whatever search criteria you use to match a login event. This also assume that your login event has a field called admin. If not, rename the admin field in the subsearch to whatever the username field is called in your login event. Then lookup the list of allowed IP addresses, see if they match the IP address in the event (assuming its in the ip field), and return the list of events.

eventtype=login [| inputlookup admin_ip | dedup admin | fields admin] | lookup admin_ip admin OUTPUT allowed_ip | eval allowed=if(ip==allowed_ip,"Y","N") | where allowed=="N"

View solution in original post

Jeremiah
Motivator

It depends on how frequently this IP list will change. You could manage the list of IP addresses in a lookup file (ie, a CSV) or you could have a scripted lookup that pulls the address list from an external source.

http://docs.splunk.com/Documentation/Splunk/6.3.3/SearchReference/Lookup

If you were using a lookup file, you'd probable have it formatted something like this, in a file called admin_ip.csv:

admin, allowed_ip
joe, 1.2.3.4
bob, 2.3.4.5

Then use a subsearch to look for your admin's activity. Substitute eventtype=login for whatever search criteria you use to match a login event. This also assume that your login event has a field called admin. If not, rename the admin field in the subsearch to whatever the username field is called in your login event. Then lookup the list of allowed IP addresses, see if they match the IP address in the event (assuming its in the ip field), and return the list of events.

eventtype=login [| inputlookup admin_ip | dedup admin | fields admin] | lookup admin_ip admin OUTPUT allowed_ip | eval allowed=if(ip==allowed_ip,"Y","N") | where allowed=="N"

View solution in original post

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.