topic Re: LOGIN SUCCESS vs LOGIN FAILURE in Security

LOGIN SUCCESS vs LOGIN FAILURE

MattQ — Thu, 07 Nov 2013 16:53:35 GMT

I have logs that return the basic text of "LOGIN SUCCESS" and "LOGIN FAILURE" but I don't seem to be able to make this a unique and interesting field. I want to be able to search logs and return a count by IP addresses of everything trying to log in and then sort those with counts by SUCCESS or FAILURE

This seems incredibly simple but I am failing at it

Re: LOGIN SUCCESS vs LOGIN FAILURE

richgalloway — Thu, 07 Nov 2013 18:04:42 GMT

Would you please provide sample log entries?

Re: LOGIN SUCCESS vs LOGIN FAILURE

MattQ — Thu, 07 Nov 2013 18:19:52 GMT

Here is a scrubbed version. Log Source and Sourcetype are defined and working well. LOGIN FAILURE looks exactly like LOGIN SUCCESS and is just plain text and doesn't return as an interesting field. The IP is out there and I can get a count to return by IP... but then I also want to see if these attempts have a SUCCESS or FAILURE associated.

<13>Nov 7 11:14:36 log source 07-Nov-2013 11:14:36 - LOGIN SUCCESS|User Attempt|0|IP list|xxx.xxx.xxx.xxx

Thank you

Re: LOGIN SUCCESS vs LOGIN FAILURE

somesoni2 — Thu, 07 Nov 2013 18:40:06 GMT

Did you tried extracting LOGIN SUCCESS or LOGIN FAILURE using field extraction?

Re: LOGIN SUCCESS vs LOGIN FAILURE

jtrucks — Thu, 07 Nov 2013 19:23:06 GMT

Use a field extraction like:

… | rex field=_raw ".*LOGIN\s(?<loginresult>(SUCCESS|FAILURE)).*"

There may be more elegant ways to do the regex, but that gives you the field named "loginresult" that will have either SUCCESS or FAILURE for each entry. That allows you to do reporting and matching on those fields. If the above works, then use that syntax to create a configured extract so the field is always available for that data source.

Re: LOGIN SUCCESS vs LOGIN FAILURE

MattQ — Thu, 07 Nov 2013 20:29:32 GMT

This definitely is breathing life into this. With this nudge I am getting there. Thank you

Re: LOGIN SUCCESS vs LOGIN FAILURE

aelliott — Thu, 07 Nov 2013 21:06:46 GMT

This quick reference guide helped me to get started http://docs.splunk.com/Documentation/Splunk/6.0/SearchReference/SearchCheatsheet#Download_the_Splunk_Quick_Reference_Guide