Can I use Splunk to identify rogue Zoom participants?

[nick405060]

Hi guys,

In our Zoom.us admin webpage, it lists Top 10 locations by meeting participants and we see a number from China. We would not expect this to be the case and we are concerned about this.

I have been trying to use Splunk to determine who these participants are, or confirm that this is simply a case of poor geolocation, or confirm that all participants really were valid. Our Splunk instance is hitting up the Zoom API per https://answers.splunk.com/answers/812377/covid-19-response-is-splunk-able-to-ingest-logs-fr.html . Unfortunately the API does not seem to have geolocation or IP data except for our own user's sign-in and sign-out attempts.

I have also been trying to leverage Splunk's Remote Work Insights (RWI) to identify these potentially rogue participants.

Does anyone have ideas for how to use Splunk to solve this problem, or do any RWI experts have experience getting this data from the Zoom API?

[nick405060 · Accepted solution]

I updated my answer to the following question, which solves this.

https://answers.splunk.com/answers/812377/covid-19-response-is-splunk-able-to-ingest-logs-fr.html

[efavreau]

@nick405060 Without your query, a log sample, and details about who made that admin webpage, I can only guess. However, I believe it may be looking at ip's of servers, instead of actual participants. Zoom has acknowledged they have servers in China. Here's only one link, but you can web search Zoom China and read up. https://techcrunch.com/2020/04/03/zoom-calls-routed-china/

You asked two distinct questions. I would also split this up here on Splunk Answers, and make a second question about RWI.