How to create Splunk alert to detect unauthorized ...

Splunk Enterprise Security

Hi,

I am trying to extract a new field to spot unauthrorised certificate usage on a server. Under event ID 4768, there is a "Certificate Information" heading followed by Certificate Issuer Name, Certificate Serial Number, and Certificate Thumbprint. Ideally, I want to extract the Certificate Thumbprint field so I can create an alert. But because the logs I have so far have empty Certificate Information fields, it's making it difficult to create an expression. Does anyone have ideas how to extract the Certificate Thumbprint field?

Regards,

Mark

Get Updates on the Splunk Community!

How to create Splunk alert to detect unauthorized certificate usage?

using Enterprise Security

Aligning Observability Costs with Business Value: Practical Strategies

Mastering Data Pipelines: Unlocking Value with Splunk

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Are you a member of the Splunk Community?

How to create Splunk alert to detect unauthorized certificate usage?

using Enterprise Security

Aligning Observability Costs with Business Value: Practical Strategies

Mastering Data Pipelines: Unlocking Value with Splunk

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0