All Apps and Add-ons

Can I use Splunk to identify rogue Zoom participants?

nick405060
Motivator

Hi guys,

In our Zoom.us admin webpage, it lists Top 10 locations by meeting participants and we see a number from China. We would not expect this to be the case and we are concerned about this.

I have been trying to use Splunk to determine who these participants are, or confirm that this is simply a case of poor geolocation, or confirm that all participants really were valid. Our Splunk instance is hitting up the Zoom API per https://answers.splunk.com/answers/812377/covid-19-response-is-splunk-able-to-ingest-logs-fr.html . Unfortunately the API does not seem to have geolocation or IP data except for our own user's sign-in and sign-out attempts.

I have also been trying to leverage Splunk's Remote Work Insights (RWI) to identify these potentially rogue participants.

Does anyone have ideas for how to use Splunk to solve this problem, or do any RWI experts have experience getting this data from the Zoom API?

0 Karma
1 Solution

nick405060
Motivator
0 Karma

nick405060
Motivator
0 Karma

efavreau
Builder

@nick405060 Without your query, a log sample, and details about who made that admin webpage, I can only guess. However, I believe it may be looking at ip's of servers, instead of actual participants. Zoom has acknowledged they have servers in China. Here's only one link, but you can web search Zoom China and read up. https://techcrunch.com/2020/04/03/zoom-calls-routed-china/

You asked two distinct questions. I would also split this up here on Splunk Answers, and make a second question about RWI.

###

If this reply helps you, an upvote would be appreciated.
0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!