How to create Splunk alert to detect unauthorized ...

Splunk Enterprise Security

Hi,

I am trying to extract a new field to spot unauthrorised certificate usage on a server. Under event ID 4768, there is a "Certificate Information" heading followed by Certificate Issuer Name, Certificate Serial Number, and Certificate Thumbprint. Ideally, I want to extract the Certificate Thumbprint field so I can create an alert. But because the logs I have so far have empty Certificate Information fields, it's making it difficult to create an expression. Does anyone have ideas how to extract the Certificate Thumbprint field?

Regards,

Mark

Get Updates on the Splunk Community!

How to create Splunk alert to detect unauthorized certificate usage?

using Enterprise Security

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

Data Persistence in the OpenTelemetry Collector

Thanks for the Memories! Splunk University, .conf25, and our Community

Are you a member of the Splunk Community?

How to create Splunk alert to detect unauthorized certificate usage?

using Enterprise Security

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

Data Persistence in the OpenTelemetry Collector

Thanks for the Memories! Splunk University, .conf25, and our Community