https://community.splunk.com/t5/Security/Basic-Brute-Force-Detection-Splunk-Security-Essentials/m-p/635508#M16634 <P>Hi There,</P><P>I am new to Splunk and have data coming in from just one server. I have tried running the basic brute force detection search, and receive thousands of events. I don't think this is accurate and thus feel as though I must have misconfigured something, somewhere. I'm not sure where I should begin to look.</P><P>Any help would be appreciated,</P><P>Jamie</P> Wed, 22 Mar 2023 15:15:28 GMT jamie1 2023-03-22T15:15:28Z https://community.splunk.com/t5/Security/Basic-Brute-Force-Detection-Splunk-Security-Essentials/m-p/635508#M16634 <P>Hi There,</P><P>I am new to Splunk and have data coming in from just one server. I have tried running the basic brute force detection search, and receive thousands of events. I don't think this is accurate and thus feel as though I must have misconfigured something, somewhere. I'm not sure where I should begin to look.</P><P>Any help would be appreciated,</P><P>Jamie</P> Wed, 22 Mar 2023 15:15:28 GMT https://community.splunk.com/t5/Security/Basic-Brute-Force-Detection-Splunk-Security-Essentials/m-p/635508#M16634 jamie1 2023-03-22T15:15:28Z https://community.splunk.com/t5/Security/Basic-Brute-Force-Detection-Splunk-Security-Essentials/m-p/635529#M16636 <P>I also noticed an error: (<SPAN>Eventtype 'bd_Authentication-audit' does not exist or is disabled).</SPAN></P> Wed, 22 Mar 2023 16:52:50 GMT https://community.splunk.com/t5/Security/Basic-Brute-Force-Detection-Splunk-Security-Essentials/m-p/635529#M16636 jamie1 2023-03-22T16:52:50Z