Splunk Search

correlating of events

ayu15
Engager

 

I want to correlate the login events of aws console to login events of cyberark.

people login to aws console via cyberark.

so need to correlate the login events of aws with cyberark, that if people are login to aws are they logining through cyberark or not.

Labels (4)
Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @ayu15 ,

without any information is difficoult to help you, I gave you two methods to build you correlation.

But using the same Hypothesis of the above answer, adding only the conditions:

  • action=login (for aws_console),
  • message="Login successful" (for cyberark),

you could try:

(index=aws_console action=login) OR (index=cyberark message="Login successful")
| rename user AS username
| stats values(index) AS index dc(index) AS dc_index earliest(_time) AS _time BY username
| where dc_index=1 AND index=aws_console 
| table _time username

In this way you have the login events in aws_console with none login event in cyberark.

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @ayu15 ,

to correlate two different sources you have to find one or more correlation key: a transaction_id should be the best otherwise you can use username or other fields.

You have two methods to do this:

  • you can use transaction that's easier but slower and you have the limit of 50,000 results in subsearch,
  • you can use stats that's less easy but quicker.

e.g. having:

  • index=cyberark, username called username,
  • index=aws_console, username called user (this is an example to display different field names),
  • using username as key.

In the first case, you you have to create something like this:

index=aws_console
| rename user AS username
| transaction username [ search index=cyberark ]
| table _time username ...

 in the second case, you you have to create something like this:

index=aws_console OR index=cyberark
| rename user AS username
| stats values(*) AS * earliest(_time) AS _time BY username
| table _time username ...

In my opinion, use always the second!

Ciao.

Giuseppe

ayu15
Engager

Hi @gcusello 

Thanks lot for the help but I am still not able to get the desired results.

please help to elaborate.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @ayu15 ,

without any information is difficoult to help you, I gave you two methods to build you correlation.

But using the same Hypothesis of the above answer, adding only the conditions:

  • action=login (for aws_console),
  • message="Login successful" (for cyberark),

you could try:

(index=aws_console action=login) OR (index=cyberark message="Login successful")
| rename user AS username
| stats values(index) AS index dc(index) AS dc_index earliest(_time) AS _time BY username
| where dc_index=1 AND index=aws_console 
| table _time username

In this way you have the login events in aws_console with none login event in cyberark.

Ciao.

Giuseppe

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...