Security

Is it possible to have eventtypes for user authentication with different events?

Path Finder

Is it possible to have eventtypes for user authentication with different events?

I am working on a TA for Aruba user authentication logs.

I have the action=success completed event 522008 but action=failure will be from another event 522042 (not the same event ID).

SAMPLE EVENTS

Successful

 Oct 19 04:19:24 awc1 authmgr[1883]: <522008> <NOTI> <awc1 192.168.1.10>  User Authentication Successful: username=john.doe MAC=08:15:96:ab:ac:e0 IP=192.168.2.10 role=authenticated VLAN=601 AP=102.168.2.1 SSID=corp AAA profile=Auth_AaaProfile auth method=802.1x auth server=radius.lab.com

Failed

Oct 19 23:57:03 awc1 authmgr[1883]: <522042> <NOTI> <awc1 192.168.1.10>  User Authentication Failed: username=john.doe MAC=08:15:96:ab:ac:e0 IP=0.0.0.0 auth method=802.1x auth server=radius.lab.com

CONFIGS

eventtypes.conf

[aruba_user_authentication]
search = sourcetype=aruba_syslog Error_ID=522008
#tags = authentication default

transforms.conf

[aruba_user_action]
REGEX = Authentication\s+(Successful|failed)
FORMAT = aruba_user_action::$1

Thanks.

0 Karma
1 Solution

Path Finder

UPDATE

By amending the search in eventtypes.conf I managed to get the failure's too..

eventtypes.conf

 [aruba_user_authentication]
 search = sourcetype=aruba_syslog Error_ID=522008 OR OR Error_ID=522042
 #tags = authentication default

View solution in original post

Path Finder

UPDATE

By amending the search in eventtypes.conf I managed to get the failure's too..

eventtypes.conf

 [aruba_user_authentication]
 search = sourcetype=aruba_syslog Error_ID=522008 OR OR Error_ID=522042
 #tags = authentication default

View solution in original post

SplunkTrust
SplunkTrust

Took me too long to type - so deleting my answer as you got it right here 🙂

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!