User Investigation - Generic

Inputs

• SplunkIndex — Splunk's index name in which to search. Default is "*" - All.
• SplunkEarliestTime — The earliest time for the Splunk search query.
• SplunkLatestTime — The latest time for the Splunk search query.
• UserEmail — The user email to search Okta logs.
• Username — User name.
• LoginCountry — The Country from which the user logged in.
• SIEMFailedLogonSearch — Whether to search for failed logon logs from Siem? Can be False or True.
• ThreatLogSearch — Whether to search for threat logs from PAN-OS? Can be False or True.
• XDRAlertSearch — Whether to search for Related alerts from XDR? Can be False or True.
• OktaSearch — Whether to search for logs from Okta? Can be False or True.
• XDRUsernameField — Cortex XDR User name Field.
• QRadarSearchTime — The Search Time for the QRadar search query. for example: Last 1 days
• AzureSearchTime — The Search Time for the Azure Log Analytics search query. for example: ago(1d)
• ASN — The ASN from which the user logged in.

Outputs

• NumOfSiemFailedLogon — Number of failed login from Siem.
• NumOfThreatLogs — Number of Threat Logs for the user from Panorama.
• PaloAltoNetworksXDR.Alert — XDR Alerts.
• ArraySize — Number of XDR alert for the user.
• PermanentCountry — True if the user work from a permanent country from Okta. False if else.
• UserDevices — Devices used by the user from Okta.
• NumOfOktaSuspiciousActivities — Number of Suspicious Activities for the user from Okta.
• SuspiciousUserActivities — Suspicious Activities for the user from Okta.
• NumOfOktaSuspiciousUserAgent — Number of Suspicious User Agent from Okta.
• SuspiciousUserAgent — Suspicious User Agent from Okta.
• UserApplication — Applications used by the user from Okta.
• NumOfOktaFailedLogon — Number of failed login from Okta.
• AzureFailedLogonLogs — The result of the Azure Log Analytics search.
• QRadar.Search.Result — The result of the QRadar search.
• Splunk.Result — The results of the Splunk search. The results are a JSON array, in which each item is a Splunk event.
• NumOfFailedLogon — Number of failed login.
• NumOfFailedLogonASN — Number of failed login from ASN by all users.

Commands used