Solved: Using Splunk to identify SSO users that use NTLM - Splunk Community

Security

Does anyone have some SPL they could share that identifies SSO users that use NTLM to authenticate? Any help with this is greatly appreciated.

1 Solution

Solution

Was able to figure this out by pulling a consistent text string produced in the SSO logs and then filtering my SPL around that.

View solution in original post

Solution

Was able to figure this out by pulling a consistent text string produced in the SSO logs and then filtering my SPL around that.

Get Updates on the Splunk Community!

Agentic Operations Start with Context: Build the Right Data Foundation

Agentic Operations Start with Context: Build the Right Data Foundation By Courtney Wright, Product Marketing ...

Assisted, Augmented or Agentic? Choose Your Splunk Starting Point

Assisted, Augmented or Agentic? Choose Your Splunk Starting Point By Courtney Wright, Product Marketing ...

Session 2 | Beyond the Thread: Operationalizing AI with Confidence

Session 2 Beyond the Thread: Operationalizing AI with Confidence The true power of the Cisco Data Fabric ...