topic Re: Splunk Account Lockout in Splunk Enterprise

Splunk Account Lockout

OsmanElyas — Mon, 17 Jul 2023 10:44:33 GMT

I have just configured Splunk and I have alert running for locked account.

It keep generating multiple entries from per lockout account

So I want to generate one message incase of account get locked

index=wineventlog source="WinEventLog:Security" sourcetype=WinEventLog action=failure Account_Name="*" user="*" AND "taskcategory=Account Lockout"

Re: Splunk Account Lockout

richgalloway — Mon, 17 Jul 2023 16:17:57 GMT

What you want is to throttle the alert. Throttling prevents the alert from firing too often. To turn on throttling, edit the alert and check the box labled "Thottle" then specify how long you want Splunk to wait before firing the alert again.

Re: Splunk Account Lockout

OsmanElyas — Tue, 18 Jul 2023 06:35:04 GMT

@richgalloway Thank you for the guide I am still facing small issue

what should be in the filed Suppress results containing field value when I click on throttle.

Re: Splunk Account Lockout

richgalloway — Fri, 21 Jul 2023 19:15:06 GMT

Use a field name that uniquely identifies the specific alert you wish to throttle. In this case, that field would be Account_Name since you don't want repeated alerts for users.

Re: Splunk Account Lockout

OsmanElyas — Mon, 24 Jul 2023 06:43:47 GMT

@richgalloway Much appreciate your support, I have implemented the report.

Re: Splunk Account Lockout

richgalloway — Mon, 24 Jul 2023 12:48:09 GMT

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.