Security

Is it possible to have eventtypes for user authentication with different events?

pjohnson1
Path Finder

Is it possible to have eventtypes for user authentication with different events?

I am working on a TA for Aruba user authentication logs.

I have the action=success completed event 522008 but action=failure will be from another event 522042 (not the same event ID).

SAMPLE EVENTS

Successful

 Oct 19 04:19:24 awc1 authmgr[1883]: <522008> <NOTI> <awc1 192.168.1.10>  User Authentication Successful: username=john.doe MAC=08:15:96:ab:ac:e0 IP=192.168.2.10 role=authenticated VLAN=601 AP=102.168.2.1 SSID=corp AAA profile=Auth_AaaProfile auth method=802.1x auth server=radius.lab.com

Failed

Oct 19 23:57:03 awc1 authmgr[1883]: <522042> <NOTI> <awc1 192.168.1.10>  User Authentication Failed: username=john.doe MAC=08:15:96:ab:ac:e0 IP=0.0.0.0 auth method=802.1x auth server=radius.lab.com

CONFIGS

eventtypes.conf

[aruba_user_authentication]
search = sourcetype=aruba_syslog Error_ID=522008
#tags = authentication default

transforms.conf

[aruba_user_action]
REGEX = Authentication\s+(Successful|failed)
FORMAT = aruba_user_action::$1

Thanks.

0 Karma
1 Solution

pjohnson1
Path Finder

UPDATE

By amending the search in eventtypes.conf I managed to get the failure's too..

eventtypes.conf

 [aruba_user_authentication]
 search = sourcetype=aruba_syslog Error_ID=522008 OR OR Error_ID=522042
 #tags = authentication default

View solution in original post

pjohnson1
Path Finder

UPDATE

By amending the search in eventtypes.conf I managed to get the failure's too..

eventtypes.conf

 [aruba_user_authentication]
 search = sourcetype=aruba_syslog Error_ID=522008 OR OR Error_ID=522042
 #tags = authentication default

MuS
SplunkTrust
SplunkTrust

Took me too long to type - so deleting my answer as you got it right here 🙂

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...