Splunk Enterprise Security

Highlight Repeat Notable Offenders

kmcaloon
Explorer

I'm trying to write a search to highlight users that have caused multiple notables over time. Using the search below, I can get a list of which users created notables each day. I'd like to modify the search to show users that have notables in more than one day period over the past 30 days. i.e. UserA created a notable on the 1st and the 2nd. Basically looking for repeat offenders. Any ideas?

notable | search NOT suppression |timechart count by user usenull=f useother=f

0 Karma

Splunker
Communicator

Im sure you have a specific use-case in mind but have you seen the "Risk Activity" dashboard in ES?

Repeat offenders tally up a score so they bubble up to the top when the risk is high enough from the total score.

The risk score is also dotted throughout ES making it easy to see.

Just in case you havent come across it is all.

Cheers.

0 Karma

kmcaloon
Explorer

I think I answered my own question. It's sort of a weird way to get the info, but I think this is accurate.

notable | search NOT suppression AND NOT rule_title=VPN |eval mytime=strftime(_time, "%Y%m%d") | makemv delim=" " user | mvexpand user |eval user=lower(user)| stats values(mytime) as Dates by user | stats count(Dates) as Number by user | where Number>=2 | rename Number as "Number of Days"| sort - "Number of Days"

0 Karma

kmcaloon
Explorer

Getting closer, but still not seeing repeats.

notable | search NOT suppression |eval mytime=strftime(_time, "%Y%m%d")| makemv delim=" " user | mvexpand user |chart count(mytime) by user usenull=f useother=f

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...