Authentication

Description

The Authentication section is intended for monitoring authorization and authentication events on hosts, in applications, and during remote connections.

Displayed Data

• number of authentication attempts
• top users by number of authentication attempts
• top authentication hosts and sources, as well as sources with authentication attempts from multiple users
• authentication event statistics broken down by users
• authentication event statistics broken down by sources

Dashboards

The section contains three dashboards with different levels of detail, from an overview of the entire infrastructure to the profile of a specific user or source.

Authentication: General Information

The dashboard provides an overview of authentication across the infrastructure for the selected period, without being tied to a specific user or source.

• metrics for the period: number of unique users and sources, successful and failed authentication attempts

• charts of successful and failed authentication attempts over time

• top 20 users with successful and failed authentication attempts

• top 20 hosts and top 20 authentication sources by number of attempts, as well as the Sources with Multiple Users table. It helps identify sources from which an abnormally large number of different accounts authenticate, which may indicate that the source has been compromised

Authentication: User Profile

The dashboard displays data filtered for a specific user (the User parameter and the user.name field). It is used during incident investigations to review the complete authentication history of an individual account: the sources and destination hosts used by the user and the result of each login. Additional filters can narrow the results by status (event.outcome), event source (event.provider), and exclude service accounts, such as СИСТЕМА, SYSTEM, and machine accounts matching *$.

• Authentication Event Statuses and Authentication Event Types: successful and failed attempt trends and the distribution of events by action type (event.action) for the selected user

• Events by Destination and Events by Information System: user event trends broken down by destination host (destination) and data source (event.provider)

• Detailed Statistics (last 20,000 events): a table of the user's events with the source (source.ip), destination, data source, result, and action type. By default, when the User filter is set to *, events for all users are displayed; after a specific user is selected, only that user's events are displayed

Authentication: Source Profile

The dashboard displays data filtered for a specific authentication source (the Source parameter and the source.ip / source.address fields), that is, the host from which authentication attempts were made. It is used to assess who authenticated from this source and how often, and whether the source may be a point of compromise for multiple accounts.

• Authentication Event Statuses and Authentication Event Types: successful and failed attempt trends and the distribution of events by action type for the selected source

• Events by Destination and Events by Information System: the destination hosts (destination) and data sources (event.provider) involved in authentication from this source

• Detailed Statistics (last 20,000 events): a table of authentication events grouped by request source, user, destination, information system, result, and action type. By default, when the Source filter is set to *, all sources are displayed; after a specific source is selected, only its events are displayed

Navigation Between Dashboards

From the Detailed Statistics table on the Source Profile dashboard, you can open the User Profile dashboard filtered by the user from the selected row. Similarly, from the Detailed Statistics table on the User Profile dashboard, you can open the Source Profile dashboard filtered by the source (source.ip) from the selected row.

---

Data Model

The section uses the following data source fields. The alias is sm_cs_auth_indexes.

Categorization Fields

Field Name	Value
event.kind	event
event.category	authentication
event.type	start | end | info
event.outcome	success | failure | unknown
event.action	From the original event

General-Purpose Fields

User user

Field Name	Value
user.name	User name or ID
user.effective.name	User name or ID for events with privilege escalation
user.effective.id	User ID for privilege escalation events in *nix systems

Source source

Source of the authentication request

Field Name	Value
source.address	Address of the authentication request source (name or IP)
source.ip	IP address of the authentication request source
source.domain	Name (hostname or FQDN) of the authentication request source

Destination destination

The location relative to which authentication is performed. For local authentication, it is the same as the source

Field Name	Value
destination.address	Address of the authentication destination (name or IP)
destination.ip	IP address of the authentication destination
destination.domain	Name (hostname or FQDN) of the authentication destination

Lookups

The following table lists the lookups used by the section

Name	Fields	Description
sm_cs_auth_default_users_lookup	user.name is_default	Default user name values
sm_cs_auth_privileged_users_lookup	user.name is_privileged	Privileged user name values

---

Source Examples

• Windows Security Log
• Linux Auditd Log
• Cisco ASA