Splunk Search

Help with Splunk Query to detect unusual logons to different computers

chriscioffi88
New Member

Good morning,

I am wondering what commands that I can use in order to detect a user account logging into a machine that is different from the norm.

Use case:

jbloggs usually logs into Computer A,
jbloggs logs into Computer B (which has never been accessed by this account before)

Any help will be greatly appreciated

Thanks in advance.

0 Karma

lakshman239
Influencer

The search depends on the data from your source. Assuming, you are looking at windows events from endpoints [ local computer], you can look at EventCode=4624 and it will give you the computer user is loging in and user id. So you could create a search something like index=your_index_name EventCode=4624 | table _time, user, Workstation_Name that could get you started.

Alternatively, if you have the data in Authentication datamodel, that can be used as well.

https://answers.splunk.com/answers/127012/how-can-i-use-windows-events-to-monitor-logon-sessions.htm...
https://gosplunk.com/user-logon-session-duration/
https://www.ultimatewindowssecurity.com/blog/default.aspx?p=26180f8b-42a6-49a2-949d-ac44494353cb

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...