Getting Data In

Create alert to show possible shared passwords

dmws
New Member

Need to create a query to be able to pull data and show when someone has either swiped in from key card reader, logged into the network, or signed on via VPN. From there i would like to setup an alert.

Ex. A user has logged onto the network, but did not swipe in the card reader and did not log in via VPN.
Ex. A user has swiped into the building via the card reader and is also logged in via VPN, but did not log into the network.

Tags (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Are you ingesting your card reader, VPN, and network logon events in Splunk?

---
If this reply helps you, Karma would be appreciated.
0 Karma

dmws
New Member

Yes, there is an index ingesting data for all three. The struggle is getting the join query to pull back the needed data or correct amount. See below query for example:

index=(network logon)
| table user, source
| join type=inner user
[ search index=active directory
| table user, department ]
| join type=left user
[ search index=(vpn)
| table user ]
| join type=left user
[ search index=(key card)
| table user, LNAME, FNAME, LOCATION]

| where department!= " "

0 Karma

richgalloway
SplunkTrust
SplunkTrust

You have a query. How is it failing? What do you want that it is not providing?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...