Dashboards & Visualizations

How to set up an alert to detect login abuse and credential leaks using geographical and timing data?

patpro
Path Finder

Hello,

I'm a SPLUNK beginner and I would need some help finding a way to achieve my goal.
I gather various login events: user login on the SSO web portal, POP/IMAP access, SSH login, etc. Each kind of event comes from a different source, but for every one I get a timestamp, a user login, and an IP address.
I would like to be able to detect when:

  • the same user login is used from two (or more) locations,
  • far from each other (say 500km),
  • in a given time window (say 5 hours).

I've found similar interests in calculation of distance between events here on splunk>answers, but none goes as far as what I need. The calculation itself is only one aspect. I'm confident SPLUNK can handle this, but I'm not sure about the bigger picture. I have no idea how to proceed to create a dynamic time window for each successful user login, for example.

Ultimately I need the process to act as a real-time trigger for security alert.

I'm pretty sure it's very complex, and I don't expect a all-in-one solution. Any help is greatly appreciated.

1 Solution

patpro
Path Finder

I've found a very interesting blog post dealing with this exact same question. The approach is smart: instead of using a time window, the request calculates the speed needed to move from one location to another. It simplifies the process a lot.

http://www.sedward5.com/detecting-credential-theft-using-splunk-geographic-information

Now I just need to learn how to create an alert based on query result.

View solution in original post

patpro
Path Finder

I've found a very interesting blog post dealing with this exact same question. The approach is smart: instead of using a time window, the request calculates the speed needed to move from one location to another. It simplifies the process a lot.

http://www.sedward5.com/detecting-credential-theft-using-splunk-geographic-information

Now I just need to learn how to create an alert based on query result.

sedward5
Engager

Thanks for sharing my blog. 😃

Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...