Checking User Login Activity in Splunk Environment

Applicability

Description

Monitoring user login activity is crucial for maintaining security and operational efficiency in Splunk. There are two primary user types:

• Splunk Local Users: Users with login credentials stored and managed within Splunk, allowing direct login with their username and password.
  
  

• SAML Users: Users who authenticate through an Identity Provider (IdP). The IdP verifies the user’s identity, while the Service Provider (SP) grants access to Splunk.
   
  SAML users are often referred to as "External Users" since their credentials are managed outside of Splunk.

Investigation

For Splunk Local Users

Login activity for Splunk Local users can be monitored in two ways:

1. Using the Splunk GUI:

   • Navigate to Settings -> Users to view all Splunk Local Users and their last login information.
     
     

2. Using Search Processing Language (SPL) Queries:

   • To check the last successful login of Local users, run the following SPL query:

| rest splunk_server=local /services/authentication/users
| search type=Splunk
| eval last_successful_login=strftime(last_successful_login, "%Y-%m-%d %H:%M:%S")
| table realname title email last_successful_login roles

• • To analyze audit logs for granted access, use this query: 

index=_audit info=granted
| stats latest(_time) as latest_timestamp by user
| eval latest_timestamp = strftime(latest_timestamp, "%Y-%m-%d %H:%M:%S")
| dedup user
| table user latest_timestamp

For SAML Users

Splunk does not store login activity data for SAML users. This information is maintained by the IdP, and the last login field will not be populated using queries such as index=_audit info=granted. Typically, SAML users are created upon their first login.

Resolution

For Splunk Local Users

1. Using the Splunk GUI:

   • Verify login activity directly through the Splunk user interface. Navigate to Settings -> Users to view all Splunk Local Users.
     
     

2. Using Search Processing Language (SPL) Queries:

   • To analyze login activity, run the following SPL query

| rest splunk_server=local /services/authentication/users
| search type=Splunk
| eval last_successful_login=strftime(last_successful_login, "%Y-%m-%d %H:%M:%S")
| table realname title email last_successful_login roles

For SAML Users

Maintaining SAML User Information

To ensure optimal functionality and user management within Splunk, maintain an up-to-date lookup table that includes all SAML user entries configured on the Identity Provider (IdP). Since Splunk does not have access to the total number of SAML users, this lookup serves as a critical resource for tracking and managing user accounts.

Regularly review and update this lookup to reflect any changes in SAML user configurations.

Monitoring User Activity in Splunk

To monitor user activity over time, leverage Splunk's internal audit logs. By correlating user entries from the lookup table with user activity recorded in these logs, valuable insights into user engagement can be gained.

• Inactive Users: If a user appears in the lookup table but shows no corresponding activity in the internal logs, this indicates inactivity over a specified period.
  
  

• Active Users: If a user is listed in the lookup and has matching activity in the internal logs, this confirms successful logins, providing clear data for tracking user engagement.