Security
Highlighted

authentication method in a query on splunk

Path Finder

Hey everyone,

Is there a way to check for which kind of authentication method is being used by splunk in a log? (Splunk itself, SAML or LDAP)

Thanks in advanced

0 Karma
Highlighted

Re: authentication method in a query on splunk

SplunkTrust
SplunkTrust

As far as I know that in splunk logs those information are not available.

0 Karma
Highlighted

Re: authentication method in a query on splunk

Path Finder

i feard that, in any case if anyone knows a work around feel free to share please

0 Karma
Highlighted

Re: authentication method in a query on splunk

SplunkTrust
SplunkTrust

Try below search (It is ugly because of join) but I think it will give you a result.

index=_audit host=<your host> action="login attempt"
| fields user, action, info, src 
| join type=left user
    [| rest /services/authentication/users splunk_server=local f=title f=type 
    | rename title as user 
    | fields user, type ]
| table user, type, action, info, src
0 Karma
Highlighted

Re: authentication method in a query on splunk

Path Finder

it did not work for me, there were users that appeared with no type (Probably because they no longer exist)

0 Karma
Highlighted

Re: authentication method in a query on splunk

Path Finder

I managed to get it working for me, but thank you for your help anyway

0 Karma
Highlighted

Re: authentication method in a query on splunk

SplunkTrust
SplunkTrust

Welcome... 🙂

0 Karma
Highlighted

Re: authentication method in a query on splunk

SplunkTrust
SplunkTrust

Yes, query which I have provided will give you type if that user exist in splunk, it it does not exist then it will give you blank.

0 Karma
Highlighted

Re: authentication method in a query on splunk

Path Finder

With the app https://splunkbase.splunk.com/app/1866/
i was able to get one of the dashboards which displayed what i wanted,

Name: Users by authentication type
Code: | rest splunk_server=local /services/authentication/users | stats count by type

View solution in original post

0 Karma
Highlighted

Re: authentication method in a query on splunk

Path Finder

It's not 100% correct since it wasn't in a log but since i got it to work i'll call it a win.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.