Other Usage

Azure API credentials Expiring in 6 months

Kwabena13
Engager

The Credentials used to connect the Splunk TA for Azure was set to expire in 6 months from now. I would like to get an alert created for that in Splunk so we can update this a week before it expires so it does not take us by surprise.

I do not want to set a personal reminder just in case someone else is in the role by then.

Thanks for your help.

 

Labels (2)
0 Karma

marnall
Motivator

You could make a lookup containing the unix time when the API key expires, along with columns describing the key and where to renew it. Then you could make an alert in Splunk that checks if that unix time is X days away

e.g.

| inputlookup when_keys_expire.csv
``` 7*24*60*60 = 1 week worth of seconds ```
| where expirytime > (now() - 7*24*60*60)

The downside to this is that you would have to manually set the lookup table separately when applying a new key.

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...