Alerting

How to create an alert to trigger when admins make a connection to a server not from their own IPs?

kalianov
Path Finder

Hi

I want to monitor admins by triggering an alert when an admin makes a connection to servers not from their own IPs. How I can do that? The question is, how to create an independent whitelist of IPs for each admin (not in search string) and match it with the logs?

I would be grateful for your ideas.

0 Karma
1 Solution

Jeremiah
Motivator

It depends on how frequently this IP list will change. You could manage the list of IP addresses in a lookup file (ie, a CSV) or you could have a scripted lookup that pulls the address list from an external source.

http://docs.splunk.com/Documentation/Splunk/6.3.3/SearchReference/Lookup

If you were using a lookup file, you'd probable have it formatted something like this, in a file called admin_ip.csv:

admin, allowed_ip
joe, 1.2.3.4
bob, 2.3.4.5

Then use a subsearch to look for your admin's activity. Substitute eventtype=login for whatever search criteria you use to match a login event. This also assume that your login event has a field called admin. If not, rename the admin field in the subsearch to whatever the username field is called in your login event. Then lookup the list of allowed IP addresses, see if they match the IP address in the event (assuming its in the ip field), and return the list of events.

eventtype=login [| inputlookup admin_ip | dedup admin | fields admin] | lookup admin_ip admin OUTPUT allowed_ip | eval allowed=if(ip==allowed_ip,"Y","N") | where allowed=="N"

View solution in original post

Jeremiah
Motivator

It depends on how frequently this IP list will change. You could manage the list of IP addresses in a lookup file (ie, a CSV) or you could have a scripted lookup that pulls the address list from an external source.

http://docs.splunk.com/Documentation/Splunk/6.3.3/SearchReference/Lookup

If you were using a lookup file, you'd probable have it formatted something like this, in a file called admin_ip.csv:

admin, allowed_ip
joe, 1.2.3.4
bob, 2.3.4.5

Then use a subsearch to look for your admin's activity. Substitute eventtype=login for whatever search criteria you use to match a login event. This also assume that your login event has a field called admin. If not, rename the admin field in the subsearch to whatever the username field is called in your login event. Then lookup the list of allowed IP addresses, see if they match the IP address in the event (assuming its in the ip field), and return the list of events.

eventtype=login [| inputlookup admin_ip | dedup admin | fields admin] | lookup admin_ip admin OUTPUT allowed_ip | eval allowed=if(ip==allowed_ip,"Y","N") | where allowed=="N"
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...