Next Page
12
Splunk Search for AD Logons for Users that Have Escalated Privileges Copy
sourcetype=syslog sudo | stats count by user host | map search="search index=ad_summary username=$user$ type_logon=ad_last_logon"
0 comments
Splunk Search for Unsuccessful OSX logins Copy
sourcetype=osx_secure | rex field=_raw "authinternal\sfaile\sto\sauthenticate\suser\s(?<user>\S+)" | stats count by user, host | sort - count
0 comments
Splunk Search for Successful OSX logins Copy
sourcetype=osx_secure | rex field=_raw "authinternal\sauthenticated\suser\s(?<user>\S+)" | stats count by user, host | sort - count
0 comments
Splunk Search for Failed linux logins by user Copy
sourcetype=linux_secure tag=authentication action=failure | stats count by user | sort - count
0 comments
Splunk Search for Successful linux logins over time Copy
sourcetype=linux_secure tag=authentication action=success | timechart count by src
0 comments
Splunk Search for Successful linux logins by source IP Copy
sourcetype=linux_secure tag=authentication action=success | stats values(user) as user, count by src
0 comments
Splunk Search for Failed linux logins by source IP Copy
sourcetype=linux_secure tag=authentication action=failure | stats values(user) as user, count by src
0 comments
Splunk Search for Successful and unsuccesful Splunk login attempts Copy
index=_audit action="log*" | stats count as Attempts by user, info | rename info as "Outcome"
0 comments
Splunk Search for Unique Splunk logons per day Copy
index=_audit info=succeeded | timechart span=1d dc(user) as "Unique Users" count(user) as "Total Logins"
0 comments
Splunk Search for Splunk failed logins Copy
index=_audit action="login attempt" info=failed | stats count as "Failed Attempts" by user | rename user as User
0 comments
Next Page
12