Manage Splunk app for Enterprise Security default account recognition

[marcoscala]

Hi All,
we're tuning the Splunk App for Enterprise Security setup for one Customer and we're experiences a LOT of Notable Events for Correlational Search "Default account activity detected"generated also for not default user accounts, but for regular user accounts.

It seems that the "default_user_accounts" macro invoked by the rule doesn't look in the identity.csv file for default users, but in another "identities_expanded.csv" lookup file. The online docs for Splunk app for ES 2.4 mention a postprocess search that generate this csv but I could't find it.

Any idea on how to clean and set the default account detection correctly?

regards,
Marco

[marcoscala]

Luke,
thanks for this clarification, but how this "identities_expanded.csv" is build? Why an account not present in "identities.csv" the appears as "default account" in "identities_expanded.csv"?

Moreover, is there a way to "reset" it?

Thanks,

Marco

[jcoates_splunk]

Hi Marco, this process is explained in the documentation link that Luke provided. Per my question, the category tag is the key here.

I expect that if you're seeing an unexpected category tag, then you've probably got multiple definitions of the account in question, one with and one without category="default".

Lastly, I would be remiss not to note that this system has been improved in the new ES 3.0; mind you, there is no fix for GIGO, so a misplaced category would still produce the unwanted result.

[LukeMurphey]

The "default_user_accounts" evaluates "identities.csv" but indirectly. To improve performance, the "identities.csv" is processed behind the scenes into "identities_expanded.csv".

Splunk will rebuild the identities_expanded.csv automatically. However, you can force it to run manually too. See the docs on "Changes to Assets and Identities"

[jcoates_splunk]

also, the important thing is the identity's category... do the regular accounts have category=default set?