Getting Data In

Can I use Splunk to monitor user and agent activity on a network to ensure adherence to policies e.g. stopping password sharing, etc?

Difference
New Member

With multiple applications both cloud and on premise in use, I am looking for a toolset which can automate the manual process of downloading a block of system logs on a periodic basis and manually looking for anomalies. Ideally I would like system logs to be loaded and reporting generated for non compliant practices e.g. sharing passwords , using restricted websites etc ?.

0 Karma

pgreer_splunk
Splunk Employee
Splunk Employee

As Sundareshr stated, Splunk would definitely be a great tool for loading and searching your data for password sharing occurrences, access to restricted sites, etc. There would need to be data within your logs that could indicate that information (if it's not there, Splunk isn't going to make the data occur for you) or there would need to be a pattern within an event or set of events that would infer the existence of a password share and/or access to a restricted site during a session/transaction.

Download the free instance or sign up for a free Cloud instance of Splunk and give it a try! 🙂

0 Karma

sundareshr
Legend

As long as the logs have something in them regarding sharing passwords and using restricted websites, yes Splunk would be a great tool to automate the manual process of downloading logs and look for anomalies.

0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...