Splunk Enterprise Security

I am setting up Authentication datamodel that have Default, insecure and Privileged Authentication

ngwodo
Path Finder

How will I set up a data model that has Authentication and sub-sessions Default, insecure and Privileged Authentication data model. It uses action of a sucess and failure.  I am using the following splunk query:    

(`cim_Authentication_indexes`) tag=authentication NOT (action=success user=*$) NOT "pam_unix(sshd:auth): authentication failure;"

 

Is there anything wrong with the above query or how can I make it to work?

 

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The EVAL and FIELDALIAS settings would like something like this.  Put them in the appropriate props.conf file.

[mysourcetype]
EVAL-vendor_product = "Microsoft Windows"
FIELDALIAS-src_ip = src_ip=src_ip_address

Once a CIM field is defined it is available for use in all parts of a datamodel.

To tag the data, create an eventtype that extracts what the datamodel is looking for then add the appropriate tag to that eventtype.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The EVAL and FIELDALIAS settings would like something like this.  Put them in the appropriate props.conf file.

[mysourcetype]
EVAL-vendor_product = "Microsoft Windows"
FIELDALIAS-src_ip = src_ip=src_ip_address

Once a CIM field is defined it is available for use in all parts of a datamodel.

To tag the data, create an eventtype that extracts what the datamodel is looking for then add the appropriate tag to that eventtype.

---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The CIM app supplies the Authentication datamodel.   Once you've installed the app, make sure your data uses the CIM fields. Add EVAL or FIELDALIAS props as necessary.

---
If this reply helps you, Karma would be appreciated.
0 Karma

ngwodo
Path Finder

Thanks for the above reply but what would be the eval expressions and field alias? Are mine going to have it for each of those authentication data model i.e. Default, Insecure and Privileged? Where will put the success and failure tags for the data model?

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...