Deployment Architecture

Is it possible to monitor when User login from suspicious country?

debjit_k
Path Finder

Hi,

im working on new use case, but was stuck in few things. 

I want to create a use case logic to monitors whenever user/IP are trying to access to log in from non authorize country. 
 
example a use is support to log in from Berlin but he or she is log in from Chicago. 

My ask

1. Is it possible from Splunk end to implement such use case
2. If yes what kind of logs we need to monitor such activity, is FW logs are enough?

3. What will be the query 

 

thanks 

Labels (2)
0 Karma

debjit_k
Path Finder

Hi @gcusello ,

im having Splunk Security Essentials app on my Splunk I will try to check there. 

I don’t understand the 2nd one public IP n lookup table.. 

It will be easy for me to understand if you could give me an sample query. 

Thank you 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @debjit_k,

using the above search you extract the Country from the ip address using the iplocation command, country that you can check using a rougue countries lookup.

For more infos see at https://docs.splunk.com/Documentation/Splunk/9.0.1/SearchReference/Iplocation

Ciao.

Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @debjit_k,

ys, it's possible.

this use case is implemented in Enterprise Security (Premium App), in ES Content Updates (https://splunkbase.splunk.com/app/3449) and in Splunk Security Essentials app (https://splunkbase.splunk.com/app/3435).

You need of a public IP and a lookup (available in Splunk) with the iplocation to associate an IP to a country.

Now I haven't these Use Cases available, but they should be something like this:

<your_search>
| iplocation src_ip 
| table src_ip Country

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...