Security

Authenication datamodel to identify when a 'breakglass' accounts has been successfully authenticated

Thundercat
Engager

Hi All,

Thanks for taking the time to review this message.

I attempting to create a Splunk notable that will allow me to detect if our organisation 'breakglass' accounts have been successfully authenticated. The existing notable uses the Authentication Data Model and this has been disable in the past for some reason.

I am attempting to revise this query to search not on one break glass account but for a few. The exist query looks something like this, as shown below.

| datamodel Authentication Successful_Authentication search | search Authentication.signature_id=4624 Authentication.user=Administrator NOT (host=AWD* OR ComputerName=EC2* OR ComputerName=WIN*)
| rename Authentication.user as user
| table src_ip, user, host
| eval urgency="critical"

I have change the Authentication.user=Administrator specifically to the userid of the one of the breakglass account, how do I include in the search for the other accounts, by using a OR operator? 

Appreciate any guidance anyone can offer and refining this SPL query.

Many thanks in advance.

Labels (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Yes, you can use OR.

| datamodel Authentication Successful_Authentication search | search Authentication.signature_id=4624 (Authentication.user=Administrator OR Authentication.user=foo OR Authentication.user=bar) NOT (host=AWD* OR ComputerName=EC2* OR ComputerName=WIN*)
...

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Yes, you can use OR.

| datamodel Authentication Successful_Authentication search | search Authentication.signature_id=4624 (Authentication.user=Administrator OR Authentication.user=foo OR Authentication.user=bar) NOT (host=AWD* OR ComputerName=EC2* OR ComputerName=WIN*)
...

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

Thundercat
Engager

Hi Rich - Hope all is well? Many thanks for getting back to me and providing a solution on the SPL query for the Notable. Already tested it this morning against certain user accounts and it is working fine. 

Thanks again for responding, it pointed me in the right direction to get this set up correctly.

0 Karma
Get Updates on the Splunk Community!

Monitoring Postgres with OpenTelemetry

Behind every business-critical application, you’ll find databases. These behind-the-scenes stores power ...

Mastering Synthetic Browser Testing: Pro Tips to Keep Your Web App Running Smoothly

To start, if you're new to synthetic monitoring, I recommend exploring this synthetic monitoring overview. In ...

Splunk Edge Processor | Popular Use Cases to Get Started with Edge Processor

Splunk Edge Processor offers more efficient, flexible data transformation – helping you reduce noise, control ...