Splunk Search

CIM Authentication data model

splunkreal
Motivator

Hello,

I would like to know the aim of this default constraint :

(`cim_Authentication_indexes`) tag=authentication NOT (action=success user=*$)
action="success"
 
Especially what does it try to match with user=*$ ? User accounts ending with $ symbol like in Windows?
 
Thanks.
 
* If this helps, please upvote or accept solution if it solved *
Labels (2)
Tags (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @splunkreal,

user names ending with $ are windows service accounts and usually they aren't relevant in authentication monitoring.

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @splunkreal,

user names ending with $ are windows service accounts and usually they aren't relevant in authentication monitoring.

Ciao.

Giuseppe

PickleRick
SplunkTrust
SplunkTrust

As far as I remember, there are two kinds of account that have names ending with $ (in Windows - for other systems it's highly unlikely that there will be an account named this way; but it would be nice to account for that) - Managed Service Accounts (which @gcusello already mentioned) and computer accounts. Both of those account types are authenticated without using interactive authentication modes so they're irrelevant to the events you're looking for in this dataset.

Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...