Security

Example of inactive account activity detected use case?

adukes_splunk
Splunk Employee
Splunk Employee

Does anyone have examples of how to use Splunk to check for inactive account activity?

0 Karma
1 Solution

adukes_splunk
Splunk Employee
Splunk Employee

The Splunk Product Best Practices team helped produce this response. Read more about example use cases in the Splunk Platform Use Cases manual.

For more information on this and other examples, download the free Splunk Security Essentials app on Splunkbase.

In this use case, we'll explore how to use Splunk Enterprise Security to discover when previously inactive accounts are being used. This may be due to an attacker that successfully gained access to an account that should no longer be used.

Load data

This use case depends on asset and identity data. Use the instructions to Add asset and identity data to Splunk Enterprise Security to allow Splunk Enterprise Security to correlate asset and identity information with events to enrich and provide context to your data. It’s a best practice to use the CIM to normalize data at search time, but before you put in effort to create new knowledge objects, check Splunkbase to see if such a CIM-compatible app or add-on already exists.

For more details about the Common Information Model, watch the following video.

Demystifying the Splunk CIM

Get insights

This scenario uses the Incident Review dashboard in Splunk Enterprise Security and underlying correlation searches. Use the following procedure to discover incidents:

  1. Navigate to the Splunk Enterprise Security web user interface.
  2. Select Incident Review from the top navigation bar.
  3. Select the text box under Correlation Search, begin typing Inactive Account Activity Detected, then select the appropriate result from the result set.
  4. Select Submit to display notable events.

Review the Overview of Incident Review in Splunk Enterprise Security in Splunk docs for guidance on how to triage and act on resulting incidents. If there are not results, there may not be any notable notable events or you may need to enable correlation searches.

Watch the following video to see how the Use Case Library in Splunk Enterprise Security can strengthen your security posture and reduce risk with readily available, usable, and relevant content.

Splunk Enterprise Security: Use Case Library

View solution in original post

0 Karma

adukes_splunk
Splunk Employee
Splunk Employee

The Splunk Product Best Practices team helped produce this response. Read more about example use cases in the Splunk Platform Use Cases manual.

For more information on this and other examples, download the free Splunk Security Essentials app on Splunkbase.

In this use case, we'll explore how to use Splunk Enterprise Security to discover when previously inactive accounts are being used. This may be due to an attacker that successfully gained access to an account that should no longer be used.

Load data

This use case depends on asset and identity data. Use the instructions to Add asset and identity data to Splunk Enterprise Security to allow Splunk Enterprise Security to correlate asset and identity information with events to enrich and provide context to your data. It’s a best practice to use the CIM to normalize data at search time, but before you put in effort to create new knowledge objects, check Splunkbase to see if such a CIM-compatible app or add-on already exists.

For more details about the Common Information Model, watch the following video.

Demystifying the Splunk CIM

Get insights

This scenario uses the Incident Review dashboard in Splunk Enterprise Security and underlying correlation searches. Use the following procedure to discover incidents:

  1. Navigate to the Splunk Enterprise Security web user interface.
  2. Select Incident Review from the top navigation bar.
  3. Select the text box under Correlation Search, begin typing Inactive Account Activity Detected, then select the appropriate result from the result set.
  4. Select Submit to display notable events.

Review the Overview of Incident Review in Splunk Enterprise Security in Splunk docs for guidance on how to triage and act on resulting incidents. If there are not results, there may not be any notable notable events or you may need to enable correlation searches.

Watch the following video to see how the Use Case Library in Splunk Enterprise Security can strengthen your security posture and reduce risk with readily available, usable, and relevant content.

Splunk Enterprise Security: Use Case Library

0 Karma

adukes_splunk
Splunk Employee
Splunk Employee

Added related video.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...