Splunk Search

Is it possible to create a view showing all events coming from an IP and/user name?

carmella_vitug
New Member

I'd like to create a dashboard where I could easily search for events coming from a specific IP address or username.

For example:

It would show where that specific IP address was logged on to, URL it accessed, if it was locked out and all that stuff considering all security appliance was added on SPLUNK such as IPS, Web Gateway, Endpoint Protection, active directory and the like.

Just like how should an SIEM should work.

Tags (1)
0 Karma

jkat54
SplunkTrust
SplunkTrust

Assuming you integrated with your IPS etc using CIM compliant TAs, then you can install the Splunk CIM and use the Intrusion Detection or the Network Traffic data models.

https://splunkbase.splunk.com/app/1621/

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...