Reporting

How to search report of all login attempts on OS-level and Splunk level?

alexievca
Loves-to-Learn Lots

Could someone tell me how can I make a search query to report of all login attempts on OS-level and Splunk level.

Thank you,
Alex

Labels (1)
0 Karma

Ginesa
Loves-to-Learn Lots

Please someone to help with this!

0 Karma

to4kawa
Ultra Champion

splunk access log :

https://docs.splunk.com/Documentation/Splunk/8.1.1/Troubleshooting/AboutAccessLogs

Do you get OS level logs? what's sourcetype?

0 Karma

alexievca
Loves-to-Learn Lots

Thank you for your reply. I think linux_secure

0 Karma

alexievca
Loves-to-Learn Lots

I have to onboard(monitor) the so called “Linux secure” OS level log in the new index that I created called linux-secure and report all login attempts on OS level and Splunk level. Then also report all failed logins and the same way on OS level and Splunk. Finally the part that is really easy to create the dashboard. That I was told to do and to be honest I am baffled as simple as it looks

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...