Security

Example of activity from an expired user?

adukes_splunk
Splunk Employee
Splunk Employee

Does anyone have examples of how to use Splunk to check for activity from expired users?

0 Karma
1 Solution

adukes_splunk
Splunk Employee
Splunk Employee

The Splunk Product Best Practices team helped produce this response. Read more about example use cases in the Splunk Platform Use Cases manual.

For more information on this and other examples, download the free Splunk Security Essentials app on Splunkbase.

In this use case, we'll explore how to use Splunk Enterprise Security to alert when an event is discovered from a user associated with an expired identity.

Load data

This use case depends on asset and identity data. Use the Add asset and identity data to Splunk Enterprise Security procedure to let Splunk Enterprise Security correlate asset and identity information with events to enrich and provide context to the data.

Get insights

This scenario uses the Incident Review dashboard in Splunk Enterprise Security and underlying correlation searches. Use the following procedure to discover incidents:

  1. Navigate to the Splunk Enterprise Security web user interface.
  2. Select Incident Review from the top navigation bar.
  3. Select the text box under Correlation Search, begin typing Activity from Expired User Identity, then select the use case from the drop-down list that appears.
  4. Select Submit to filter the results.

Review the Overview of Incident Review in Splunk Enterprise Security in Splunk docs for guidance on how to triage and act on resulting incidents. If no results appear, there may not be any notable notable events. However, you may need to enable correlation searches.

Watch the following video to see how the Use Case Library in Splunk Enterprise Security can strengthen your security posture and reduce risk with readily available, usable and relevant content.

Splunk Enterprise Security: Use Case Library

View solution in original post

0 Karma

adukes_splunk
Splunk Employee
Splunk Employee

The Splunk Product Best Practices team helped produce this response. Read more about example use cases in the Splunk Platform Use Cases manual.

For more information on this and other examples, download the free Splunk Security Essentials app on Splunkbase.

In this use case, we'll explore how to use Splunk Enterprise Security to alert when an event is discovered from a user associated with an expired identity.

Load data

This use case depends on asset and identity data. Use the Add asset and identity data to Splunk Enterprise Security procedure to let Splunk Enterprise Security correlate asset and identity information with events to enrich and provide context to the data.

Get insights

This scenario uses the Incident Review dashboard in Splunk Enterprise Security and underlying correlation searches. Use the following procedure to discover incidents:

  1. Navigate to the Splunk Enterprise Security web user interface.
  2. Select Incident Review from the top navigation bar.
  3. Select the text box under Correlation Search, begin typing Activity from Expired User Identity, then select the use case from the drop-down list that appears.
  4. Select Submit to filter the results.

Review the Overview of Incident Review in Splunk Enterprise Security in Splunk docs for guidance on how to triage and act on resulting incidents. If no results appear, there may not be any notable notable events. However, you may need to enable correlation searches.

Watch the following video to see how the Use Case Library in Splunk Enterprise Security can strengthen your security posture and reduce risk with readily available, usable and relevant content.

Splunk Enterprise Security: Use Case Library

0 Karma

adukes_splunk
Splunk Employee
Splunk Employee

Added related video.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...