topic Re: Failed Logins followed by Success Corp Wifi? in Security

Failed Logins followed by Success Corp Wifi?

ahmar74 — Tue, 29 Sep 2020 18:40:09 GMT

here is my string i just cant seem to figure out the x number of failures followed by success:

| tstats count values(Authentication.action) as Action, values(Authentication.user) as User, values(Authentication.Calling_Station_ID) as "MAC Address", values(Authentication.src) as Source from datamodel="Authentication"."Authentication" where (index=acs Authentication.action!=success Authentication.src!=10.242.*) by Authentication.user | brain freeze....

Re: Failed Logins followed by Success Corp Wifi?

mmontgomery_spl — Tue, 27 Mar 2018 18:52:56 GMT

There are a few ways, but I like this one as it is a little simpler to modify for other use cases as well:

| from datamodel:"Authentication"."Authentication" | stats values(user) values(Calling_Station_ID) count(eval('action'=="success")) as success, count(eval('action'=="failure")) as failure by src | search success>1 failure>20

Re: Failed Logins followed by Success Corp Wifi?

wenthold — Tue, 27 Mar 2018 19:14:09 GMT

I don't think tstats is the way to go since you're analyzing data in aggregate. You might want to look at the answer Woodcock posted earlier: https://answers.splunk.com/answers/368521/how-can-i-detect-a-successful-login-after-multiple.html

You could approximate it with tstats, but I don't believe you can account for consecutive events using tstats with something like:

| tstats `summariesonly` count as failure_count from datamodel=Authentication where Authentication.action=failure earliest=-4h@h latest=-5m@m by Authentication.user, Authentication.app, _time
| join type=left Authentication.user, Authentication.app, _time  [| tstats `summariesonly` count as success_count from datamodel=Authentication where Authentication.action=success earliest=-4h@h latest=-5m@m by Authentication.user, Authentication.app, _time]
| where failure_count>3 and success_count>1

.. but this won't account for the sequence of events, it will only find where they occur together, and any sequence spanning one of the time periods won't properly be accounted for.