Solved: Using Splunk to identify SSO users that use NTLM - Splunk Community

Security

Does anyone have some SPL they could share that identifies SSO users that use NTLM to authenticate? Any help with this is greatly appreciated.

1 Solution

Solution

Was able to figure this out by pulling a consistent text string produced in the SSO logs and then filtering my SPL around that.

View solution in original post

Solution

Was able to figure this out by pulling a consistent text string produced in the SSO logs and then filtering my SPL around that.

Get Updates on the Splunk Community!

Think Like an Architect: Introducing the Splunk Certified Cybersecurity Defense ...

In cybersecurity, defenders respond to threats. Architects design the systems that stop them. As ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...