Splunk Enterprise Security

List of users on Linux and Windows clients, how we can get it?

infosec_kicb
New Member

Hi guys,
Nothing comes to mind. How to get a list of users in operating systems using splunk forwarder?

0 Karma

saramamurthy_sp
Splunk Employee
Splunk Employee

Are you speaking about Linux or Splunk Users?

if Linux Users, you have to install on your forwarder a TA-Linux that contains a script to collect Linux users.

If you don't want to install the full TA_Linux, you can take only the script to extract users ($SPLUNK_HOME/etc/apps/Splunk_TA_nix/ bin/usersWithLoginPrivs.sh).

After you can search them in Splunk with a simple search ( index=os | dedup users | table users ).

Cheers.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...