Create alert to show possible shared passwords

[dmws]

Need to create a query to be able to pull data and show when someone has either swiped in from key card reader, logged into the network, or signed on via VPN. From there i would like to setup an alert.

Ex. A user has logged onto the network, but did not swipe in the card reader and did not log in via VPN.
Ex. A user has swiped into the building via the card reader and is also logged in via VPN, but did not log into the network.

[richgalloway]

Are you ingesting your card reader, VPN, and network logon events in Splunk?

[dmws]

Yes, there is an index ingesting data for all three. The struggle is getting the join query to pull back the needed data or correct amount. See below query for example:

index=(network logon)
| table user, source
| join type=inner user
[ search index=active directory
| table user, department ]
| join type=left user
[ search index=(vpn)
| table user ]
| join type=left user
[ search index=(key card)
| table user, LNAME, FNAME, LOCATION]

| where department!= " "

[richgalloway]

You have a query. How is it failing? What do you want that it is not providing?