Splunk Search

how to write splunk query for watching abuse of a service account?

lakshmikolli201
New Member

Hello,

I want to write a detection for watching abuse of a service being used. How to do i start writing the logic. any help would be appreciated.
thank you.

0 Karma

vikramyadav
Contributor
  1. So the best practices for writing a query is not but at least you should know by which index you have to search for your events. Suppose let's take an example you have your events in index=abc
  2. And then choose your source or sourcetype
  3. Check events and search for field or a key word like in your case is "service"
  4. List item and then try to frame query
  5. Query will look like index=abc source=service_account service! =granted | table service
0 Karma

lakshmikolli201
New Member

Detection for abuse of service account being used

0 Karma

starcher
SplunkTrust
SplunkTrust

Rich is asking what do you mean by abuse?

Count of failures? Count of success? By source? Over a given time range? From a given source to a number of destinations in a given time window?

You always need to start with defining the criteria of what you mean when using terms like abuse, unusual, unexpected etc when creating detections. That drives what you do in SPL.

0 Karma

lakshmikolli201
New Member

Hi Rich,

Thanks for your response.

abuse means unusual authentications, interactive activity, suspicious processes. I would like to build detections for any of these terms. could you please suggest me how can I proceed further with this?

thank you,
Lakshmi

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Check out the Splunk Security Essentials app (https://splunkbase.splunk.com/app/3435/).

---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please explain what "abuse of service account" means to you.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...