topic Re: Email Alerts in Splunk Enterprise Security

Email Alerts

luckymaddy — Tue, 28 Apr 2015 15:47:52 GMT

Hi,

I want to set an “Email alert when User failed login 5 times in last 10 minutes.
Please help me.

Thanks in Advance

Re: Email Alerts

juvetm — Tue, 28 Apr 2015 18:38:38 GMT

can you try something like this

* 10 /* * * *

Re: Email Alerts

stephane_cyrill — Mon, 28 Sep 2020 19:42:11 GMT

HI luckymaddy,

1-write your request that gives you the failed login as you want. it depends on your data.it may be something like:

source=security_log_file failed login earliest=10| timechart count by user|where count> 5

2-execute it in search and click SAVE AS ALERT.

3-on the first window put the title and chose what you want.....

4- on the 2nd window click SEND E-MAIL and fill the required informations. you can even customize the message to send by including a token value.

5-click save.

see all the details here:

docs.splunk.com/Documentation/Splunk/6.2.2/Alert/Alertexamples

Re: Email Alerts

mdessus_splunk — Tue, 28 Apr 2015 20:32:41 GMT

Edit the "Excessive failed login" default correlation search, change the count in the search, and edit the time parameters (Start time, End time, Cron Schedule) to run it each 10 minutes as said before.