Splunk Search

CIM Authentication data model

splunkreal
Motivator

Hello,

I would like to know the aim of this default constraint :

(`cim_Authentication_indexes`) tag=authentication NOT (action=success user=*$)
action="success"
 
Especially what does it try to match with user=*$ ? User accounts ending with $ symbol like in Windows?
 
Thanks.
 
* If this helps, please upvote or accept solution if it solved *
Labels (3)
Tags (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @splunkreal,

user names ending with $ are windows service accounts and usually they aren't relevant in authentication monitoring.

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @splunkreal,

user names ending with $ are windows service accounts and usually they aren't relevant in authentication monitoring.

Ciao.

Giuseppe

PickleRick
SplunkTrust
SplunkTrust

As far as I remember, there are two kinds of account that have names ending with $ (in Windows - for other systems it's highly unlikely that there will be an account named this way; but it would be nice to account for that) - Managed Service Accounts (which @gcusello already mentioned) and computer accounts. Both of those account types are authenticated without using interactive authentication modes so they're irrelevant to the events you're looking for in this dataset.

Get Updates on the Splunk Community!

Unlock New Opportunities with Splunk Education: Explore Our Latest Courses!

At Splunk Education, we’re dedicated to providing top-tier learning experiences that cater to every skill ...

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...