Installation

Account user monitoring- What is a search that I can create an alert and weekly scheduled report?

woodlandrelic
Path Finder

Hi

Am trying to create an alert and a weekly scheduled report for user"us.admin" in Splunk. I want to get an alert if this user login and activities if possible. Am already monitoring the path and pushing into Splunk. What are the appropriate search strings to do this? Thanks

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @woodlandrelic,

if you want to trace all the successful logins of a user in an alert to all you Linux systems, you should use something like this:

index=os "accepted password" 
| stats count values(host) AS host BY user

in this way you have all the logins of each user with the indication of the logged hosts.

If you want to monitor only one host, you can put it in the main search.

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @woodlandrelic,

what's the system to monitor: windows, linux, which one?

Then, which condition do you want to monitor: failed logins, or logins out of work time, which one?

To monitor a user is a too generic question.

Ciao.

Giuseppe

woodlandrelic
Path Finder

Hi @gcusello

Sorry the system is Linux. I want to see an alert anytime that accout login. So Login sir. Thank you.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @woodlandrelic,

if you want to trace all the successful logins of a user in an alert to all you Linux systems, you should use something like this:

index=os "accepted password" 
| stats count values(host) AS host BY user

in this way you have all the logins of each user with the indication of the logged hosts.

If you want to monitor only one host, you can put it in the main search.

Ciao.

Giuseppe

woodlandrelic
Path Finder

@gcusello

Thank you very much. I will try it once I login later this morning.

Am fairly new to Splunk. Is there a cheat sheet, search strings, and commands to enhance my SPL? Thanks again.

0 Karma

gcusello
SplunkTrust
SplunkTrust

HI @woodlandrelic,

you can start from the Splunk Search Tutorial (https://docs.splunk.com/Documentation/Splunk/latest/SearchTutorial/WelcometotheSearchTutorial) then ther are meny videos in the YouTube Splunk Channel and many courses, some of them free (https://www.splunk.com/en_us/training/free-courses/overview.html)

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...