Getting Data In

Create alert to show possible shared passwords

dmws
New Member

Need to create a query to be able to pull data and show when someone has either swiped in from key card reader, logged into the network, or signed on via VPN. From there i would like to setup an alert.

Ex. A user has logged onto the network, but did not swipe in the card reader and did not log in via VPN.
Ex. A user has swiped into the building via the card reader and is also logged in via VPN, but did not log into the network.

Tags (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Are you ingesting your card reader, VPN, and network logon events in Splunk?

---
If this reply helps you, Karma would be appreciated.
0 Karma

dmws
New Member

Yes, there is an index ingesting data for all three. The struggle is getting the join query to pull back the needed data or correct amount. See below query for example:

index=(network logon)
| table user, source
| join type=inner user
[ search index=active directory
| table user, department ]
| join type=left user
[ search index=(vpn)
| table user ]
| join type=left user
[ search index=(key card)
| table user, LNAME, FNAME, LOCATION]

| where department!= " "

0 Karma

richgalloway
SplunkTrust
SplunkTrust

You have a query. How is it failing? What do you want that it is not providing?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...