Security

authentication method in a query on splunk

rsaude
Path Finder

Hey everyone,

Is there a way to check for which kind of authentication method is being used by splunk in a log? (Splunk itself, SAML or LDAP)

Thanks in advanced

0 Karma
1 Solution

rsaude
Path Finder

With the app https://splunkbase.splunk.com/app/1866/
i was able to get one of the dashboards which displayed what i wanted,

Name: Users by authentication type
Code: | rest splunk_server=local /services/authentication/users | stats count by type

View solution in original post

0 Karma

rsaude
Path Finder

With the app https://splunkbase.splunk.com/app/1866/
i was able to get one of the dashboards which displayed what i wanted,

Name: Users by authentication type
Code: | rest splunk_server=local /services/authentication/users | stats count by type

0 Karma

rsaude
Path Finder

It's not 100% correct since it wasn't in a log but since i got it to work i'll call it a win.

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

As far as I know that in splunk logs those information are not available.

0 Karma

rsaude
Path Finder

i feard that, in any case if anyone knows a work around feel free to share please

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Try below search (It is ugly because of join) but I think it will give you a result.

index=_audit host=<your host> action="login attempt"
| fields user, action, info, src 
| join type=left user
    [| rest /services/authentication/users splunk_server=local f=title f=type 
    | rename title as user 
    | fields user, type ]
| table user, type, action, info, src
0 Karma

rsaude
Path Finder

it did not work for me, there were users that appeared with no type (Probably because they no longer exist)

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Yes, query which I have provided will give you type if that user exist in splunk, it it does not exist then it will give you blank.

0 Karma

rsaude
Path Finder

I managed to get it working for me, but thank you for your help anyway

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Welcome... 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...