Getting Data In

How to create an alert for password sharing across multiple countries for all logins across different hosts and applications with more than 60 indexes?

vellas78
New Member

I tried using this query:

index=* tag=authentication action=success OR action=failure

Initially to retrieve user logins from all the applications and devices but I think it will take more time and also the load and search time on the index will create performance issues. Kindly suggest some solution.

0 Karma
1 Solution

FrankVl
Ultra Champion

Sounds like a typical case to use an accelerated data model. In this case accelerating the CIM Authentication Data Model over the relevant set of indexes could be a solution worth trying.
http://docs.splunk.com/Documentation/CIM/4.10.0/User/Setup#Accelerating_CIM_data_models

That way, authentication events from all these indexes are checked periodically (depending on your acceleration settings) and the key fields are stored in data model summaries.

This would allow you to do an efficient tstats based query over the data in your accelerated data model, to for instance count the number of logins by _time, user, src and action and then apply further logic to that, to determine accounts being shared between systems that are in different locations.

View solution in original post

0 Karma

FrankVl
Ultra Champion

Sounds like a typical case to use an accelerated data model. In this case accelerating the CIM Authentication Data Model over the relevant set of indexes could be a solution worth trying.
http://docs.splunk.com/Documentation/CIM/4.10.0/User/Setup#Accelerating_CIM_data_models

That way, authentication events from all these indexes are checked periodically (depending on your acceleration settings) and the key fields are stored in data model summaries.

This would allow you to do an efficient tstats based query over the data in your accelerated data model, to for instance count the number of logins by _time, user, src and action and then apply further logic to that, to determine accounts being shared between systems that are in different locations.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...