Security

Authenication datamodel to identify when a 'breakglass' accounts has been successfully authenticated

Thundercat
Engager

Hi All,

Thanks for taking the time to review this message.

I attempting to create a Splunk notable that will allow me to detect if our organisation 'breakglass' accounts have been successfully authenticated. The existing notable uses the Authentication Data Model and this has been disable in the past for some reason.

I am attempting to revise this query to search not on one break glass account but for a few. The exist query looks something like this, as shown below.

| datamodel Authentication Successful_Authentication search | search Authentication.signature_id=4624 Authentication.user=Administrator NOT (host=AWD* OR ComputerName=EC2* OR ComputerName=WIN*)
| rename Authentication.user as user
| table src_ip, user, host
| eval urgency="critical"

I have change the Authentication.user=Administrator specifically to the userid of the one of the breakglass account, how do I include in the search for the other accounts, by using a OR operator? 

Appreciate any guidance anyone can offer and refining this SPL query.

Many thanks in advance.

Labels (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Yes, you can use OR.

| datamodel Authentication Successful_Authentication search | search Authentication.signature_id=4624 (Authentication.user=Administrator OR Authentication.user=foo OR Authentication.user=bar) NOT (host=AWD* OR ComputerName=EC2* OR ComputerName=WIN*)
...

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Yes, you can use OR.

| datamodel Authentication Successful_Authentication search | search Authentication.signature_id=4624 (Authentication.user=Administrator OR Authentication.user=foo OR Authentication.user=bar) NOT (host=AWD* OR ComputerName=EC2* OR ComputerName=WIN*)
...

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

Thundercat
Engager

Hi Rich - Hope all is well? Many thanks for getting back to me and providing a solution on the SPL query for the Notable. Already tested it this morning against certain user accounts and it is working fine. 

Thanks again for responding, it pointed me in the right direction to get this set up correctly.

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

New This Month - Observability Updates Give Extended Visibility and Improve User ...

This month is a collection of special news! From Magic Quadrant updates to AppDynamics integrations to ...

Intro to Splunk Synthetic Monitoring

In our last post, we mentioned that the 3 key pieces of observability – metrics, logs, and traces – provide ...