Splunk Search

Searching Cisco ASA sourcetype in Splunk

eholz1
Contributor

Hello All,

I would like some suggestions. I am trying to search the Cisco ASA sourcetype in Splunk for the current users that are logged in to an ASA. I am trying to use "last 24 hours" as the start time range.

I am trying to count login message (113004) and compare with logout message (722023).

There are other message ids for logout:716002, 113019. It seems that I need the "latest" login. The user can log in and log out - I can get pairs by user for a login/logout.

If there is a pair like that I can assume the user is not logged in. The challenge comes with the fact the user can have logged in and out multiple times. My theory is that if a user has more logins that logouts (assuming there is a login later than a log out). this should be a user that is logged on. The trick seems to be finding the latest log in per user, and counting values in the "message_id" field. Any suggestions here? I  can check users on the ASA using the "show vpn-session summary" command, but that number almost never matches my searches.

I can use any suggestion.

Thanks

eholz1

 

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

One way to do that is to search for all login and logout events then throw out all except the most recent event for each user.  Then discard all logouts and what's left will be logins without matching logouts.

index=foo sourcetype=cisco:asa message IN (113004 722023 716002 113019)
| eval type = if(message=113004, "login", "logout")
| dedup user
| where type="login"
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

One way to do that is to search for all login and logout events then throw out all except the most recent event for each user.  Then discard all logouts and what's left will be logins without matching logouts.

index=foo sourcetype=cisco:asa message IN (113004 722023 716002 113019)
| eval type = if(message=113004, "login", "logout")
| dedup user
| where type="login"
---
If this reply helps you, Karma would be appreciated.

eholz1
Contributor

Hello richgalloway,

 

Thanks for the reply. At least I know my "logic" is correct! Thanks for the reply, and even answers to my previous posts.  I will try your suggested search.

The community is a valuable resource.

eholz1

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...