Splunk Enterprise Security

How to alert when a rogue/unknown device is plugged into network

pradeep577
Path Finder

Hi,

I need to be alerted when a rogue/unknown device is plugged into network.
Any help will be appreciated.

0 Karma

pruthvikrishnap
Contributor

Hi, this is a bit generic question. One thing that i would do is
1) Identify to which index is the network logs going
2) Whitelist all known devices into a lookup file
3) create an alert using a search which compares the host names and alert if it sees any new device.
If you have some sample events i can help with search, also look in Splunk base if you can find a related app which can do this for you.

0 Karma

pradeep577
Path Finder

Thank you for your kind response...yes its generic question.

Would it be best to have CMDB( config. management DB) pulled into SIEM & run the search against it.

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!