topic Re: Count Consecutive Failed Logins Events in Splunk Search

Count Consecutive Failed Logins Events

Sagar0511 — Tue, 29 Sep 2020 20:04:38 GMT

We have our test environment in which Splunk Enterprise OVA is installed as server and Windows server (with universal forwarder installed) which is client. From these windows server all the logs are forwarder. I want to find the the consecutive failed logins events within the time span of 1 min. If a next event is successful logon in the middle of the failed logins, it should ignored. Each event has a field which tells whether it was success or failure.

For Ex: I have tried using the below query.

1. index=wineventslog EventCode=4625 | eval Result=if((EventCode=4625), "FAILED", "SUCCESSFUL") | streamstats count time_window=1m | table Account_Name,Result,dest,ComputerName | dedup Account_Name

2. index=wineventslog EventCode=4625 | streamstats count time_window=1m | table Account_Name,action,dest,ComputerName | dedup Account_Name

Any help to resolve this issue.
Thanks

Re: Count Consecutive Failed Logins Events

gcusello — Mon, 18 Jun 2018 13:31:21 GMT

Hi Sagar0511,
if you want all the failed login in a minute, you could use a search like this:

index=wineventslog EventCode=4625 
| stats values (Account_Name) AS Account_Name values(dest) AS dest values(ComputerName) AS ComputerName count

If you want to know the login failed for each Account_Name you can add the clause BY at the end of the search

index=wineventslog EventCode=4625 
| stats values (Account_Name) AS Account_Name values(dest) AS dest values(ComputerName) AS ComputerName count BY Account_Name

If instead a saccessful login resets the count you can use something like this:

index=wineventslog EventCode=4624 OR EventCode=4625 
| transaction startswith="EventCode=4625" endswith="EventCode=4624"
| table Account_Name dest ComputerName eventcount

If a saccessful login resets the count and you want the count for user you can use something like this

index=wineventslog EventCode=4624 OR EventCode=4625 
| transaction Account_Name startswith="EventCode=4625" endswith="EventCode=4624"
| table Account_Name dest ComputerName eventcount

Bye.
Giuseppe

Re: Count Consecutive Failed Logins Events

Rishabh_McKc — Tue, 26 Jun 2018 12:04:41 GMT

above answer is not valid for consecutive failed attempts