Find SonicWall Admin login's using splunk

Question

I would like to use splunk to report on when the Admnin credentials are used to login to the Sonicwall. Please help

Answer 1

From https://software.sonicwall.com/Manual/232-001835-00_Rev_A_SonicOS_Log_Event_Reference_Guide.pdf , it looks like the log message for an administrator login is "Administrator login allowed"

So in Splunk, you would just need to search for the following to get all the events

index=sonicwall "Administrator login allowed"

You may also want Administrator login failures, which are "Administrator login denied due to bad credentials"

If you want to put this in a report, something like the following should suffice

index=sonicwall "Administrator login allowed" OR "Administrator login denied due to bad credentials" | eval type=if(match(_raw,"allowed"),"success","failure") | timechart count by type