"whoami" Command execution on servers

thisal.randima

Hi All,

Got an alert on executing the "whoami" command on one of our servers. The alert was triggered on SIEM. Is there a possibility that this is something SolarWinds is doing as part of its normal monitoring, either for NPM or a SAM job? Is there a way to confirm this? 

Thanks.

midniteskys

Yes, it is possible that the "whoami" command was executed by SolarWinds as part of its normal monitoring. SolarWinds NPM and SAM both use the "whoami" command to gather information about the operating system of the server they are monitoring. This information is used to determine which monitoring modules to load, and to configure the monitoring process.

Here are a few ways to confirm that the "whoami" command was executed by SolarWinds:

• Check the SolarWinds logs for the time period around when the alert was triggered. The logs should show that SolarWinds was running a job that included the "whoami" command.

• Review the SolarWinds configuration for the affected server. The configuration should show that SolarWinds is configured to collect the operating system information.

Here are some additional tips for preventing this type of alert:

• Configure SolarWinds to use a different command to gather operating system information. For example, you could use the "uname" command instead of the "whoami" command.

• Create a filter in your SIEM to ignore alerts for the "whoami" command. This will help to reduce the number of false positives.

• Monitor the SolarWinds logs for any suspicious activity. This will help you to identify any potential security issues.