Authenication datamodel to identify when a 'breakglass' accounts has been successfully authenticated

[Thundercat]

Hi All,

Thanks for taking the time to review this message.

I attempting to create a Splunk notable that will allow me to detect if our organisation 'breakglass' accounts have been successfully authenticated. The existing notable uses the Authentication Data Model and this has been disable in the past for some reason.

I am attempting to revise this query to search not on one break glass account but for a few. The exist query looks something like this, as shown below.

| datamodel Authentication Successful_Authentication search | search Authentication.signature_id=4624 Authentication.user=Administrator NOT (host=AWD* OR ComputerName=EC2* OR ComputerName=WIN*)
| rename Authentication.user as user
| table src_ip, user, host
| eval urgency="critical"

I have change the Authentication.user=Administrator specifically to the userid of the one of the breakglass account, how do I include in the search for the other accounts, by using a OR operator? 

Appreciate any guidance anyone can offer and refining this SPL query.

Many thanks in advance.

[richgalloway · Accepted solution]

Yes, you can use OR.

| datamodel Authentication Successful_Authentication search | search Authentication.signature_id=4624 (Authentication.user=Administrator OR Authentication.user=foo OR Authentication.user=bar) NOT (host=AWD* OR ComputerName=EC2* OR ComputerName=WIN*)
...

[Thundercat]

Hi Rich - Hope all is well? Many thanks for getting back to me and providing a solution on the SPL query for the Notable. Already tested it this morning against certain user accounts and it is working fine. 

Thanks again for responding, it pointed me in the right direction to get this set up correctly.