Splunk Enterprise Security

ES Default Rule Tuning

Paladium
New Member

The below search in ES is quite complex and we need to have it tuned. If the account expires on the weekend, like on a Saturday, when the user logs in on Monday it will tag the event as matching the rule and fire the alert. It does not allow for any grace time between the expiring date and the next log in date. This rule, as written, is creating too many (false positive) alerts.

What I would like to see is a 4 day grace period to account for weekends (including long weekends) UNLESS the number of attempts to log into the expired account >10. If >10 then fire the alert.

Suggestions?

ES default rule [Activity from Expired User Identity]:

(NOT sourcetype=stash) AND (src_user_endDate=* OR user_endDate=*) | mktime(src_user_endDate,"%m/%d/%y %H:%M") | mktime(user_endDate,"%m/%d/%y %H:%M")| search (user_endDate<time() OR src_user_endDate<time()) | eval users_description=case(isnotnull(user) AND isnotnull(src_user) AND src_user!=user AND user_endDate<time() AND src_user_endDate<time(), user." \ ".src_user, src_user_endDate<time() AND isnotnull(src_user), src_user, user_endDate<time() AND isnotnull(user), user) | get_event_id | map_notable_fields

0 Karma

jcoates_splunk
Splunk Employee
Splunk Employee

It's a lot easier to read in the current version 🙂

that said, I'd probably use the dayDiff macro to tweak this behavior (http://docs.splunk.com/Documentation/ES/3.0.1/User/Macros#Utilities)

Or even better, look at what you're eval-lng to "expired account" in the identities load... it's intended for "this person no longer works here" rather than "this person's password is expired". The former is not a FP on the weekend following a termination, but I agree that the latter is FP.

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...