Getting Data In

Create alert to show possible shared passwords

dmws
New Member

Need to create a query to be able to pull data and show when someone has either swiped in from key card reader, logged into the network, or signed on via VPN. From there i would like to setup an alert.

Ex. A user has logged onto the network, but did not swipe in the card reader and did not log in via VPN.
Ex. A user has swiped into the building via the card reader and is also logged in via VPN, but did not log into the network.

Tags (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Are you ingesting your card reader, VPN, and network logon events in Splunk?

---
If this reply helps you, Karma would be appreciated.
0 Karma

dmws
New Member

Yes, there is an index ingesting data for all three. The struggle is getting the join query to pull back the needed data or correct amount. See below query for example:

index=(network logon)
| table user, source
| join type=inner user
[ search index=active directory
| table user, department ]
| join type=left user
[ search index=(vpn)
| table user ]
| join type=left user
[ search index=(key card)
| table user, LNAME, FNAME, LOCATION]

| where department!= " "

0 Karma

richgalloway
SplunkTrust
SplunkTrust

You have a query. How is it failing? What do you want that it is not providing?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...