Security Jiujitsu

Techniques – Common InformaEon Model
tag=authenEcaEon | chart count over src by acEon | where success>0 AND
failure>10
If you leverage Splunk’s Common InformaEon Model you can write one
search across many products.
The above search could cover twenty different products, all with matching
field extracEons
Most searches in this session will be based on the common
informaEon model
Try with the ES Sandbox!
16