Security

Authenication datamodel to identify when a 'breakglass' accounts has been successfully authenticated

Thundercat
Engager

Hi All,

Thanks for taking the time to review this message.

I attempting to create a Splunk notable that will allow me to detect if our organisation 'breakglass' accounts have been successfully authenticated. The existing notable uses the Authentication Data Model and this has been disable in the past for some reason.

I am attempting to revise this query to search not on one break glass account but for a few. The exist query looks something like this, as shown below.

| datamodel Authentication Successful_Authentication search | search Authentication.signature_id=4624 Authentication.user=Administrator NOT (host=AWD* OR ComputerName=EC2* OR ComputerName=WIN*)
| rename Authentication.user as user
| table src_ip, user, host
| eval urgency="critical"

I have change the Authentication.user=Administrator specifically to the userid of the one of the breakglass account, how do I include in the search for the other accounts, by using a OR operator? 

Appreciate any guidance anyone can offer and refining this SPL query.

Many thanks in advance.

Labels (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Yes, you can use OR.

| datamodel Authentication Successful_Authentication search | search Authentication.signature_id=4624 (Authentication.user=Administrator OR Authentication.user=foo OR Authentication.user=bar) NOT (host=AWD* OR ComputerName=EC2* OR ComputerName=WIN*)
...

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Yes, you can use OR.

| datamodel Authentication Successful_Authentication search | search Authentication.signature_id=4624 (Authentication.user=Administrator OR Authentication.user=foo OR Authentication.user=bar) NOT (host=AWD* OR ComputerName=EC2* OR ComputerName=WIN*)
...

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

Thundercat
Engager

Hi Rich - Hope all is well? Many thanks for getting back to me and providing a solution on the SPL query for the Notable. Already tested it this morning against certain user accounts and it is working fine. 

Thanks again for responding, it pointed me in the right direction to get this set up correctly.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...