1.If you have your SSO/MFA data ingested and parsed correctly, also using Splunk's TA's most of them come with out of the box tags that can be used to search for the data type. Simple Example - This will search for authentication data across your defined indexes - and present the results (The tags search for authentication data) You can add your sourcetypes as well index=linux OR index=Windows OR index=my_SSO_data tag=authentication You can find the tags via GUI – easy way, or inspects the TA itself (eventtypes and tags) 2. If you have not ingested data then you need to ensure the below. Example Okta SSO / MFA - Okta would provide authentication data somewhere, in logs or API, you then need to onboard this data into Splunk, ensure there is a TA that helps with the parsing and tagging, then analyse the data, to see what it gives you and run various queries to give you the results you are looking for.  Windows Event logs normally give you authentication data, based on AD / Logon events, they also provide Azure AD/ Entra, so if you used these you again would need to ingest that data into Splunk first and then run queries.    Side note: Using Splunk you can check with TA’s have tags for authentication | rest splunk_server=local services/configs/conf-tags | rename eai:acl.app AS app, title AS tag | table app tag authentication This will show you the eventtypes which are associated with tags | rest splunk_server=local services/configs/conf-eventtypes | rename eai:acl.app AS app, title AS eventtype | table app search eventtype   ... View more

If you look under lookups,  it should show that those are all set and defined. So double check lookup up tables files / Lookup definitions / Automatic Lookups and check sysmon app context.  Also check if there's another lookup with that name, sometimes I have seen another same name  #this should point to most of the sysmon TA code (transforms) or show another. /opt/splunk/bin/splunk cmd btool transforms list eventcode --debug   ... View more

In order for Splunk to present the metrics and data you want; you need to look at how the web tool can output to any logs or does it use API. then you need to look at that data, logs or API data and see if it contains the metrics or data you want. You then need a plan of how to ingest that data into Splunk. Splunk has many methods of collecting data, via Splunk HTTP- HEC / API JSON/XML, Agents (Universal forwarder) so it can collect those logs you’re interested in and  ingest into a Splunk index for you to search and generate insights and then create the dashboards, alerts, based on your metrics etc. There is a good talk soon - might be worth joining this for you to get some concept knowledge on getting data in https://community.splunk.com/t5/Community-Office-Hours/Getting-Data-In-Splunk-Platform-Wed-9-11-24/ec-p/690523#M105  ... View more