Splunk Search

Help with Splunk Query to detect unusual logons to different computers

chriscioffi88
New Member

Good morning,

I am wondering what commands that I can use in order to detect a user account logging into a machine that is different from the norm.

Use case:

jbloggs usually logs into Computer A,
jbloggs logs into Computer B (which has never been accessed by this account before)

Any help will be greatly appreciated

Thanks in advance.

0 Karma

lakshman239
SplunkTrust
SplunkTrust

The search depends on the data from your source. Assuming, you are looking at windows events from endpoints [ local computer], you can look at EventCode=4624 and it will give you the computer user is loging in and user id. So you could create a search something like index=your_index_name EventCode=4624 | table _time, user, Workstation_Name that could get you started.

Alternatively, if you have the data in Authentication datamodel, that can be used as well.

https://answers.splunk.com/answers/127012/how-can-i-use-windows-events-to-monitor-logon-sessions.htm...
https://gosplunk.com/user-logon-session-duration/
https://www.ultimatewindowssecurity.com/blog/default.aspx?p=26180f8b-42a6-49a2-949d-ac44494353cb

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...