Hi guys, I´m trying to integrate Splunk with SAML authentication and as you may know I have to download a file from Azure and another from Splunk and upload them in the other platform. The thing is that the file I download from Splunk has the "location" field (which is the hostname IP) separated via "-" and not "." so Azure can´t resolve the hostname. This is the "Location" field:  Also, when I change this value manually it breaks my distributed search configured on m indexers. Does anyone know how to replace this value in order for Azure to resolve the hostname and finish this SAML integration?   ... View more

Hi guys, I need to configure an alert when people access as root in a server and for that I have two types of events: one that contains when people accesses as root: Oct 16 15:52:55 *host* sshd[10873]: Accepted password for root from *IP* port 49745 ssh2 And another that contains the person that was using that IP (used to log as root) in the moment the conexion was established: Oct 16 17:09:11 *host* openvpn[20236]: *user*/:1194 MULTI_sva: pool returned IPv4=*IP*, IPv6=(Not enabled) So I need to correlate this two types of events in order to know which persons were using the IP that logged as root in the moment that happened. This is the search i've been using: index=wineventlog eventtype=windows_logon_success | eval so="Windows" | eval user=if(isnull(Nombre_de_cuenta),user,mvindex(Nombre_de_cuenta, -1)) | append [search index=os source="/var/log/secure" user="root" eventtype=sshd_authentication | eval so="Linux"] | rex field=dest "(?<dest>.+?)\." | rex field=src "(?<src_hostname>.+?)\." | eval src=if(len(src_hostname)>2,src_hostname,src) | where src!=dest | search user=root | rex "m\s(?<IP>\S+)" | search IP=* | append [search index=gw_pfsense "openvpn" IPv4=*] | rex "for\s(?<root>\S+)" | convert ctime(_time) as time   What else could I try? Thanks in advance ... View more