Password Security is a framework for monitoring password security that allows to find compromised passwords by checking Microsoft Windows authentication logs for usernames that contain passwords.
Use case includes a set of rules to perform real-time regex search for passwords in usernames containing numbers, special characters etc. As a result, we form list of hostnames and affected users that are likely compromised – someone could see password on the screen when user mistyped it, also authentication failure is logged to Windows Event Log that is not encrypted.
Thus, all accounts discovered by the use case must be investigated further. Dashboard displays list of hosts with compromised passwords, spikes of such authentication events and last 50 events. Initial version monitors only Microsoft Windows events, next version is already in R&D to include any authentication logs.
Use case includes a set of rules to perform real-time regex search for passwords in username fields containing number, special characters etc. As a result, there is a list of hostnames and affected users that are likely compromised – someone could see password on the screen when user mistyped it, also authentication failure is logged to Windows Event Log that is not encrypted. Dashboard displays list of hosts with compromised passwords, spikes of such authentication events and last 50 events.
Documentation is available at https://my.socprime.com/en/integrations/password-security-splunk">SOC Prime web site.
Any feedback is welcome at dev@socprime.com.
More details and documentations are available at SOC Prime web site (https://my.socprime.com/en/integrations/password-security-splunk).
Version 1.0
- Initial version.
As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.