All Apps and Add-ons

Can I use Splunk to identify rogue Zoom participants?

nick405060
Motivator

Hi guys,

In our Zoom.us admin webpage, it lists Top 10 locations by meeting participants and we see a number from China. We would not expect this to be the case and we are concerned about this.

I have been trying to use Splunk to determine who these participants are, or confirm that this is simply a case of poor geolocation, or confirm that all participants really were valid. Our Splunk instance is hitting up the Zoom API per https://answers.splunk.com/answers/812377/covid-19-response-is-splunk-able-to-ingest-logs-fr.html . Unfortunately the API does not seem to have geolocation or IP data except for our own user's sign-in and sign-out attempts.

I have also been trying to leverage Splunk's Remote Work Insights (RWI) to identify these potentially rogue participants.

Does anyone have ideas for how to use Splunk to solve this problem, or do any RWI experts have experience getting this data from the Zoom API?

0 Karma
1 Solution

nick405060
Motivator
0 Karma

nick405060
Motivator

I updated my answer to the following question, which solves this.

https://answers.splunk.com/answers/812377/covid-19-response-is-splunk-able-to-ingest-logs-fr.html

0 Karma

efavreau
Motivator

@nick405060 Without your query, a log sample, and details about who made that admin webpage, I can only guess. However, I believe it may be looking at ip's of servers, instead of actual participants. Zoom has acknowledged they have servers in China. Here's only one link, but you can web search Zoom China and read up. https://techcrunch.com/2020/04/03/zoom-calls-routed-china/

You asked two distinct questions. I would also split this up here on Splunk Answers, and make a second question about RWI.

###

If this reply helps you, an upvote would be appreciated.
0 Karma
Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...