Alerting

Detecting Successful Connections from a User Account

itsmevic
Communicator

Quick Question guys,

Is there any way to detect if there were any successful connection using an account called "donotuse" or other well known/built-in accounts that are not in our AD environment? Rather than seeing a failure and acting on that, it seems that if something were successful, that would be a REAL security issue. Any insight or help is GREATLY appreciated.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Assuming you already log successful connections, you'll need to create a list of built-in account names that you can use to filter the logs against.

---
If this reply helps you, Karma would be appreciated.
0 Karma

itsmevic
Communicator

Hi Rich, thanks for the reply. Do you have the SPL by chance that will look for successful connections? I assume you are referring to creating a lookup table list that contains built-in accounts that I can bounce my query off of?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Yes, a lookup table should work well. The SPL will depend on where you get your connection info and how it is indexed. The Splunk Security Essentials app should have some examples, though.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

A Guide To Cloud Migration Success

As enterprises’ rapid expansion to the cloud continues, IT leaders are continuously looking for ways to focus ...

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...