Dashboards & Visualizations

Dashboard for Successfully Login in Linux and Windows

shubhajits
New Member

Hi Splunk Community 

I am completely new on splunk. I somehow managed to deploy the splunk Universal Forwarder on many linux nodes and few windows systems. 

I am able to view  the /var/log/secure and /var/log/message that are getting indexed and the windows security event log on the created index.

I want a dashboard that shows information of the below :-

1. Number of Hosts where splunk forwarder is deployed (linux and windows separate).

2. Successfull and failed login.

3. Alert when root is logged in linux and Administrator login in windows.

Labels (1)
0 Karma

gcusello
Esteemed Legend

Hi @shubhajits,

you're asking many easy things:

1)

to have the list of servers that are sending logs, you could run something like this:

| metasearch index=os or index=wineventlog
| stats count BY index

but in this case you have only the servers that are sending logs, if a server is missing you haven't it, but this is another question that you can search in Community.

2)

For successul or unsuccessful logins there's a problem, that every windows login generates around 10-12 login events (EventCode=4624) so the results could be non reliable.

Anyway, the search could be (for windows) something like this:

index=wineventlog EventCode=4624 OR EventCode=4625
| stats count BY EventCode

and for Linux, something like this:

search = index=os sourcetype=linux_secure NOT disconnect ("accepted password" OR "failed password")
| eval action=if(searchmatch("accepted password"),"Login","LogFail")
| stats count BY action

If you want all in one panel it's just a little bit complicate because you should create four eventtypes:

  • windows_login (index=wineventlog EventCode=4624)
  • windows_logfail (index=wineventlog EventCode=4625)
  • linux_login (index=os "accepted password")
  • linux_logfail (index=os "failed password")

using the above searches and associating to eventtypes LOGIN or LOGOUT tags, then you can run a simple search using tags:

tag=LOGIN OR tag=LOGFAIL
| stats count BY index tag

3)

About the alert for root or administrator, you have to search for the eventtypes windows_login or linux_login and the words root or administrator, something like this:

tag=LOGIN (root OR administrator)

 

Only one final hint: follow the Search Tutorial to understand SPL.

Ciao.

Giuseppe

0 Karma

lakshman239
SplunkTrust
SplunkTrust

For dashboards, you would need to create the search matching your need and save it as a view. I would also suggest you completing https://www.splunk.com/en_us/training/free-courses/splunk-fundamentals-1.html  and looking at Splunk dashboards example app and Splunk unix app in splunk base - https://splunkbase.splunk.com/app/273/  

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...