Alerting

cloud login alert

LS
New Member

Hello all,

I'm kinda new to SIEMs and I'm trying to create an alert/rule that will notify me when a machine makes a cloud transaction, e.g. file transfer, or even a dropbox login. no success so far. my current query is:

sourcetype=WinEventLog:Security (EventCode=630) | eval status=case(EventCode=630, "Dropbox Sign in") |transaction user startswith=status="Dropbox" endswith=status="Successfully" maxevents=1 | where duration < 10

any help? Thanks in advance!

Tags (1)
0 Karma

adonio
Ultra Champion

hello there,
i am not sure whether the search you provided can assist you with your use case.
windows event code 630 is about user account deleted. read here for full description:
https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=630
there are other ways to capture file transfer from the OS level logs, but if Dropbox is the case (or other SaaS that has pre-built integrations with splunk) why not use the pre-built app and | or TA
in this case: https://splunkbase.splunk.com/app/2755/
bring the dropbox data in and see the wonders and power of splunk.

0 Karma

LS
New Member

Sir Adonio,

first of all, thank you very much for your answer! you are correct, I must say, but im looking for ways to create a rule for suspicious logins. There should be a way to include let's say X sites (azure,dropbox, wetransfer etc) and declare if "domain name contains "dropbox/azure/wetransfer". then alert me. Please pardon me for my english, but my actual objective is to create a rule. I'll still consider your suggestions though!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...