Splunk Enterprise Security

Splunk ES - Detect Cleartext Passwords search not working

efheem
Explorer

Hello,

I have  the below use case to detect Cleartext Passwords at rest

| from datamodel:"Compute_Inventory"."Cleartext_Passwords" | stats max(_time) as "lastTime",latest(_raw) as "orig_raw",values(tag) as "tag",count by "dest","user","password"

This datamodel runs the below search query 

(`cim_Compute_Inventory_indexes`) tag=inventory (tag=cpu OR tag=memory OR tag=network OR tag=storage OR (tag=system tag=version) OR tag=user OR tag=virtual) tag=user password=*

But I am not getting any results. There are events like below which says password=x (I know its fetching from /etc/passwd) and not cleartext password, but still, I do not see any results when I do a pivot. Can someone please tell me why?

 

 

image.png

When I remove password=* and do a preview, I see password=x. Password is properly being extracted as a separate field when I run the query for its sourcetype and index.

 

image.png

0 Karma

BenjaminAbben
Loves-to-Learn

Hi,

 

its an old question but for other people that are having this problem.

 

for your datamodel to work you need to fill that datamodel with your events in order to get that datamodel filled.

next is that there must be events (so create a test event) to know what to add towards that model.

 

see splunk doc's how to ingest data into an datamodel.

 

0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...