Splunk Enterprise Security

Highlight Repeat Notable Offenders

kmcaloon
Explorer

I'm trying to write a search to highlight users that have caused multiple notables over time. Using the search below, I can get a list of which users created notables each day. I'd like to modify the search to show users that have notables in more than one day period over the past 30 days. i.e. UserA created a notable on the 1st and the 2nd. Basically looking for repeat offenders. Any ideas?

notable | search NOT suppression |timechart count by user usenull=f useother=f

0 Karma

Splunker
Communicator

Im sure you have a specific use-case in mind but have you seen the "Risk Activity" dashboard in ES?

Repeat offenders tally up a score so they bubble up to the top when the risk is high enough from the total score.

The risk score is also dotted throughout ES making it easy to see.

Just in case you havent come across it is all.

Cheers.

0 Karma

kmcaloon
Explorer

I think I answered my own question. It's sort of a weird way to get the info, but I think this is accurate.

notable | search NOT suppression AND NOT rule_title=VPN |eval mytime=strftime(_time, "%Y%m%d") | makemv delim=" " user | mvexpand user |eval user=lower(user)| stats values(mytime) as Dates by user | stats count(Dates) as Number by user | where Number>=2 | rename Number as "Number of Days"| sort - "Number of Days"

0 Karma

kmcaloon
Explorer

Getting closer, but still not seeing repeats.

notable | search NOT suppression |eval mytime=strftime(_time, "%Y%m%d")| makemv delim=" " user | mvexpand user |chart count(mytime) by user usenull=f useother=f

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...