Getting Data In

Compare SSH users against authorized user list.

nickabal
New Member

I have a table that shows the usernames logging into to my various servers. I want to compare these results to a list of users I have specified in order to notice any users that should not be accessing certain systems.

Basically, I am looking to that verify usernames are in the "authorized user" array/list.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

That can be solved well with a lookup. For example, define a CSV file that contains two columns:

username,status
bob,okay
john,deleted

Define an automatic lookup that appends the status column to your search results based on the username. Then look for users that either have no value for status or have a value different from "okay".

You could also do lookups against a database, or join data from a second indexed source - what is best depends on your environment.

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) v3.54.0

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v3.54.0 and ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...