Splunk Search

correlating of events

ayu15
Engager

 

I want to correlate the login events of aws console to login events of cyberark.

people login to aws console via cyberark.

so need to correlate the login events of aws with cyberark, that if people are login to aws are they logining through cyberark or not.

Labels (4)
Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @ayu15 ,

without any information is difficoult to help you, I gave you two methods to build you correlation.

But using the same Hypothesis of the above answer, adding only the conditions:

  • action=login (for aws_console),
  • message="Login successful" (for cyberark),

you could try:

(index=aws_console action=login) OR (index=cyberark message="Login successful")
| rename user AS username
| stats values(index) AS index dc(index) AS dc_index earliest(_time) AS _time BY username
| where dc_index=1 AND index=aws_console 
| table _time username

In this way you have the login events in aws_console with none login event in cyberark.

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @ayu15 ,

to correlate two different sources you have to find one or more correlation key: a transaction_id should be the best otherwise you can use username or other fields.

You have two methods to do this:

  • you can use transaction that's easier but slower and you have the limit of 50,000 results in subsearch,
  • you can use stats that's less easy but quicker.

e.g. having:

  • index=cyberark, username called username,
  • index=aws_console, username called user (this is an example to display different field names),
  • using username as key.

In the first case, you you have to create something like this:

index=aws_console
| rename user AS username
| transaction username [ search index=cyberark ]
| table _time username ...

 in the second case, you you have to create something like this:

index=aws_console OR index=cyberark
| rename user AS username
| stats values(*) AS * earliest(_time) AS _time BY username
| table _time username ...

In my opinion, use always the second!

Ciao.

Giuseppe

ayu15
Engager

Hi @gcusello 

Thanks lot for the help but I am still not able to get the desired results.

please help to elaborate.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @ayu15 ,

without any information is difficoult to help you, I gave you two methods to build you correlation.

But using the same Hypothesis of the above answer, adding only the conditions:

  • action=login (for aws_console),
  • message="Login successful" (for cyberark),

you could try:

(index=aws_console action=login) OR (index=cyberark message="Login successful")
| rename user AS username
| stats values(index) AS index dc(index) AS dc_index earliest(_time) AS _time BY username
| where dc_index=1 AND index=aws_console 
| table _time username

In this way you have the login events in aws_console with none login event in cyberark.

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...