Search code examples
splunksplunk-query

Splunk queries: unsuccessful logins or logins with accounts locked, logins with OCONUS IP

I am using Splunk (7.3.3) and I am having tremendous difficulties trying to create a dashboard that can show (or 'report') the following information:

  1. unsuccessful admin logins
  2. unsuccessful admin logins after duty hours (WINDOWS, ALL HOURS RIGHT NOW)
  3. admin logins from OCONUS IPs
  4. admin logon with account locked
  5. attempts to logon with expired password
  6. unsuccessful attempts to bypass login or logins not enforcing PKI, multifactor, and or modified authentication enforcement
  7. system time outs
  8. system memory spikes
  9. system network traffic spikes
  10. system errors

I feel like the majority of these would be common things that people want to use to track these type of issues for their applications and was wondering if anybody would be available to share queries they have used in Splunk 7.3.3.

For simpler stuff such as Windows logons (event code) I am having success using the following query: index=windows EventCode=4624 | stats count BY TargetUserName - I also pipe in some AND NOTs to prune out bad logs that I am not interested in but took them out for sake of query

For Windows Admin Logins.. I am creating a report that runs query index=* source="*WinEventLog:Security" EventCode=4720 OR (EventCode=4732 Administrators) and add the report to the dashboard.

Solution

  • Some of those questions have example answers in the Splunk Security Essentials app. Others may be answered by the Splunk Essentials for Infrastructure Troubleshooting and Monitoring app or another app. See apps.splunk.com for these and other apps that may help.

    Looking for OCONUS logins is a matter of using the iplocation command to map an IP address to a country and filtering out all the "United States" results, this leaving only OCONUS logins (mostly).

    Unsuccessful attempts to bypass login may or may not be reported. This depends on the specific application or device. Likewise for unenforced PKI, MFA, etc. Or, you may need to correlate logs from separate sources, such as AD for login and another source for MFA.