Getting Data In

Create alert to show possible shared passwords

dmws
New Member

Need to create a query to be able to pull data and show when someone has either swiped in from key card reader, logged into the network, or signed on via VPN. From there i would like to setup an alert.

Ex. A user has logged onto the network, but did not swipe in the card reader and did not log in via VPN.
Ex. A user has swiped into the building via the card reader and is also logged in via VPN, but did not log into the network.

Tags (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Are you ingesting your card reader, VPN, and network logon events in Splunk?

---
If this reply helps you, Karma would be appreciated.
0 Karma

dmws
New Member

Yes, there is an index ingesting data for all three. The struggle is getting the join query to pull back the needed data or correct amount. See below query for example:

index=(network logon)
| table user, source
| join type=inner user
[ search index=active directory
| table user, department ]
| join type=left user
[ search index=(vpn)
| table user ]
| join type=left user
[ search index=(key card)
| table user, LNAME, FNAME, LOCATION]

| where department!= " "

0 Karma

richgalloway
SplunkTrust
SplunkTrust

You have a query. How is it failing? What do you want that it is not providing?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...