Splunk Enterprise Security

How to alert when a rogue/unknown device is plugged into network

pradeep577
Path Finder

Hi,

I need to be alerted when a rogue/unknown device is plugged into network.
Any help will be appreciated.

0 Karma

pruthvikrishnap
Contributor

Hi, this is a bit generic question. One thing that i would do is
1) Identify to which index is the network logs going
2) Whitelist all known devices into a lookup file
3) create an alert using a search which compares the host names and alert if it sees any new device.
If you have some sample events i can help with search, also look in Splunk base if you can find a related app which can do this for you.

0 Karma

pradeep577
Path Finder

Thank you for your kind response...yes its generic question.

Would it be best to have CMDB( config. management DB) pulled into SIEM & run the search against it.

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!