Good morning,
I am wondering what commands that I can use in order to detect a user account logging into a machine that is different from the norm.
Use case:
jbloggs usually logs into Computer A,
jbloggs logs into Computer B (which has never been accessed by this account before)
Any help will be greatly appreciated
Thanks in advance.
The search depends on the data from your source. Assuming, you are looking at windows events from endpoints [ local computer], you can look at EventCode=4624 and it will give you the computer user is loging in and user id. So you could create a search something like index=your_index_name EventCode=4624 | table _time, user, Workstation_Name that could get you started.
Alternatively, if you have the data in Authentication datamodel, that can be used as well.
https://answers.splunk.com/answers/127012/how-can-i-use-windows-events-to-monitor-logon-sessions.htm...
https://gosplunk.com/user-logon-session-duration/
https://www.ultimatewindowssecurity.com/blog/default.aspx?p=26180f8b-42a6-49a2-949d-ac44494353cb