topic Validate success versus failed logins in Alerting

Validate success versus failed logins

bworrellZP — Wed, 11 Apr 2018 15:08:24 GMT

I was asked if we can run a report / create an alert to act on the following:

Accounts that have had failed logins, but never a successful login, within a defined time window. The goal is to determine is an account has ever been used successfully, and if it has not, then it can be sent to the access management team to review.

In my data, I have the default _time but also have a time field from the source of "LoginAttemptDateTime". For login status, I have a field called "LoginStatus", and of course user field of "User".

Looking at some of the Brute force posts offered ideas, but nothing that gave me exactly what I was asked for. Hoping someone has another idea.

Thanks in advance

Re: Validate success versus failed logins

damien_chillet — Wed, 11 Apr 2018 15:26:34 GMT

I would run a distinct count on LoginStatus per user and retrieve the LoginStatus values then keep the one with distinct count equal to one (only Successful or Failed logins) and values set to "Failed":

index=yourindex sourcetype=yoursourcetype 
| stats dc(LoginStatus) as dc,  values(LoginStatus) as LoginStatus by User
| search dc=1 AND LoginStatus="Failed"

Re: Validate success versus failed logins

bworrellZP — Thu, 12 Apr 2018 11:25:55 GMT

Okay, this is good, they (management) liked it. They had two questions. Can we add the amount of times the login was tried, and can we also add the ones that did login successfully, and show the failed counts for those.

I am going to try and mess with this some, as the distinct count option was not one I had thought of.

Re: Validate success versus failed logins

HeinzWaescher — Tue, 29 Sep 2020 18:59:19 GMT

I would try something like:

 index=yourindex sourcetype=yoursourcetype 
| stats count(eval(LoginStatus="succeeded")) as succeeded_logins,  count(eval(LoginStatus="failed")) as failed_logins, count(LoginAttemptDateTime) AS total_attempts BY User

With this you can set filters like:

| search succeeded_logins=0 AND failed_logins>0

2.
| search succeded_logins>0
| stats count avg(total_attempts) AS avg_attempts

Re: Validate success versus failed logins

bworrellZP — Fri, 13 Apr 2018 10:01:58 GMT

Excellent, your suggestion was able to get me where I needed you go. Thank you