Getting Data In

How to monitor SSH logins to our Splunk server?

naqviah
Explorer

Is there a way to monitor Splunk server logon/logoff, basically trying to find the best way to audit access to Splunk servers via direct UI or SSH?

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

This should get you started.

index=_internal source="*/splunkd_ui_access.log" (uri_path="*/account/login" method="POST") OR (uri_path="*/account/logout")  | table _time user clientip method status uri_path
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

This should get you started.

index=_internal source="*/splunkd_ui_access.log" (uri_path="*/account/login" method="POST") OR (uri_path="*/account/logout")  | table _time user clientip method status uri_path
---
If this reply helps you, Karma would be appreciated.

naqviah
Explorer

What would be the best query to monitor SSH logins to the Splunk Server?

0 Karma
Get Updates on the Splunk Community!

Security Highlights | November 2022 Newsletter

 November 2022 2022 Gartner Magic Quadrant for SIEM: Splunk Named a Leader for the 9th Year in a RowSplunk is ...

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...