topic Re: Alert - Brute Force Attacks in Alerting

Alert - Brute Force Attacks

monteirolopes — Thu, 06 Oct 2016 13:20:14 GMT

Hello guys,

I would like to know how to set an alert that will list attempts of brute force attacks.
At moment I'm created the follow query:

source="WinEventLog:Security" | transaction user, ip maxpause=5s maxevents=500 | where eventcount > 5 | table user, ip, eventcount

5 login attempts in 5 seconds by user.

In my case, how to save this query like an alert? Is it scheduled or real-time?
Is it possible do this alert?
Can anybody help me?

Best regards,
Lopes.

Re: Alert - Brute Force Attacks

inventsekar — Thu, 06 Oct 2016 14:42:35 GMT

after the search query bar and just above the time-picker, you have a "Save As" down drop menu.
it will give you three options - Report, Dashboard panel, Alert. choose the 3rd one - Alert.

Scheduled Vs Real-time alerts - for alert type comparisions -
http://docs.splunk.com/Documentation/Splunk/6.4.3/Alert/AlertTypesOverview

this is for creating scheduled alerts -
http://docs.splunk.com/Documentation/Splunk/6.4.3/Alert/Definescheduledalerts

once the alert condition got matched (5 login attempts in 5 seconds by user), you can create an email notification -
http://docs.splunk.com/Documentation/Splunk/6.4.3/Alert/Emailnotification

Re: Alert - Brute Force Attacks

monteirolopes — Thu, 06 Oct 2016 16:26:15 GMT

I didn't understand the rules/conditions for my alert trigger.
On my query I am listing only the results that I want receive form mail, but, How Can I set the alert for this case?

Thanks.

Re: Alert - Brute Force Attacks

inventsekar — Thu, 06 Oct 2016 16:31:50 GMT

for this requirement, you can choose the trigger condition as "Number of Results is greater than 0"

Re: Alert - Brute Force Attacks

monteirolopes — Thu, 06 Oct 2016 18:04:46 GMT

And about the type: scheduled? Every 5 seconds ? How I do that?

Re: Alert - Brute Force Attacks

inventsekar — Thu, 06 Oct 2016 18:14:44 GMT

Maybe, you can choose a real time alerting.
regarding alert scheduling, maybe, you can choose "every min" and check for 60 logins. (60logins in 60 seconds)

Re: Alert - Brute Force Attacks

monteirolopes — Thu, 06 Oct 2016 18:41:38 GMT

It does not work in real-time , the amount of events is incremental.
Alert scheduling (60 login in 60 seconds) doesn't configure brute force attack.