Help with writing this search to detect users accessing unauthorized devices?

[alaking]

Hello,

I am trying to create a correlation search that will detect users accessing devices for which they aren't authorized to use. For example, Vendor A should not be able to Access a specific file server because that is not part of their assigned role. My theory is as follows:

Create a summary index search that logs AD events including username, src, dest etc. based on whether their username is in a lookup table. This lookup table has 2 fields: User and Vendor Name. I have tried the following search with little success:

 index=wineventlog dest!=mailServer dest!=DomainController Account_Domain=Domain  
| search [| inputlookup vendor_users.csv | return 1000 $user] | stats count by user
| rename user as username
| appendcols [| inputlookup vendor_users.csv| search user=$username$ | return 1000 $vendor_name]

All I expect from the search above is a table with user, vendor_name and count as fields. However, this just creates and empty column called "search", when I omit the search part it shows "VendorA OR VendorB or VendorC" etc.
This summary index will contain |table _time,user,vendor_name,src, dest which will then be used in another search using other lookup tables that provide an ACL matrix based on Vendor.

Can anyone provide any insight into what is wrong with my logic?

Regards,

[DalJeanis · Accepted solution]

Not sure where you got that syntax. Try this...

  index=wineventlog dest!=mailServer dest!=DomainController Account_Domain=Domain  
 | search  [| inputlookup vendor_users.csv | table user] 
 | stats count by user
 | lookup vendor_users.csv user OUTPUT vendor_name

If you want to see what the inputlookup language turns into as it returns from the subsearch, then play with this...

| inputlookup vendor_users.csv | table user | format