Solved: Using Splunk to identify SSO users that use NTLM - Splunk Community

Security

Does anyone have some SPL they could share that identifies SSO users that use NTLM to authenticate? Any help with this is greatly appreciated.

1 Solution

Solution

Was able to figure this out by pulling a consistent text string produced in the SSO logs and then filtering my SPL around that.

View solution in original post

Solution

Was able to figure this out by pulling a consistent text string produced in the SSO logs and then filtering my SPL around that.

Get Updates on the Splunk Community!

Kick the Tires Before You Commit: A Hands-On Tour of the Splunk Observability Cloud ...

Evaluating an enterprise observability platform usually goes like this: fill out a form, get a free trial with ...

Deep insights, no barriers: Splunk Observability Cloud Free Edition

As software delivery cycles continue to accelerate, observability shouldn’t be a luxury — it should be a ...

Monitoring AI Agents with Splunk Observability Cloud

Let’s say I’m running a travel planning AI app in production. A user asks for three concise hotel options in ...