Splunk Search

intrusion/ips

hyahmadi
Explorer

hello,
how can I know, intrusion attempts by searching in logs ips on splunk ?
how to better approach the problem would be greatly appreciated
thanks

Tags (3)
0 Karma

MuS
Legend

Or like @alacercogitatus would say:

Traveling, as oft I'm inclined to do here in the lands of Broadality, I've routinely been the victim, nay, the fool of many a disagreeable happenstance. Recalling, as I will in my hours of twilight, a specific time. Caravanning with mine family, more than a fortnight from home, we happened upon the establishment of one Mr. Ibra. A young old man of about 75, invited us to dine and rest within his Tavern. Suffice it to say, we were much inclined, having been wearied by the road. Upon waking the following morn, we discovered, much to our chagrin, our horses and coach had been stolen(robbed). Slowly our minds recalled the evening prior, and learned of the malice and trickery that was our host. We asked a passer-by, more than one, but not one soul had heard the name Mr. Ibra. He had vanished. In his supposed room lay only a few articles of cloth, and some dust from the beginning of time. But wait! Rejoice! Here lay a rock! A clue! A means to our renewed veneration! "Quick!" we shouted, "follow his trail!", for the rock was an outlier, a piece of the puzzle! We hurdled over logs, and trails, and caches of treasures so rich with nothing on our minds except vengeance. Suddenly, upon the path of our newest enlightenment, we halt, confused. Stretching, there in vast adornment, were the Caves of Splunktonia. Wonderous! Stupendous! ........ Here must our story end. For it is not for me to decide for the reader, nay, the reader must decide upon the path to action. For one soul heads down one cave, the other, another. I shall leave you to your own devices, but know this: Doth ye the knowledge seek?  Therefore then you shall find the meek, but not unto your own, for only with the constant hone, of learned ways of Brothel's stone, the information will appear, and justice will be swift and near. 

Ayn
Legend

This is way too vague and broad a question to answer properly.

Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...

Updated Data Management and AWS GDI Inventory in Splunk Observability

We’re making some changes to Data Management and Infrastructure Inventory for AWS. The Data Management page, ...