topic Re: Search to count the number of failed logins since last successful login in Splunk Search

Search to count the number of failed logins since last successful login

jds2726 — Mon, 11 Jan 2021 16:13:59 GMT

Hey everyone, I'm trying to write a search that will show the login events that occurred after the last successful logon event. So far I have this:

index="[index name]" sourcetype=WinEventLog "eventcode=4625" earliest=lastLogon | eval lastLogon=

where lastLogin = the time value of the last event from this search:

index="[index name]" sourcetype=WinEventLog "eventcode=4624"

Failed Logons: index="[index name]" sourcetype=WinEventLog "EventCode=4625"

Successful Logons: index="[index name]" sourcetype=WinEventLog "EventCode=4624"

Does anyone have an idea of how to evaluate this?

Re: Search to count the number of failed logins since last successful login

gcusello — Mon, 11 Jan 2021 16:47:14 GMT

Hi @jds2726,

you could use the transaction command bu it isn't very efficient (e.g. number of logfail >10):

index="[index name]" sourcetype=WinEventLog (EventCode=4624 OR EventCode=4625) | trasnsaction Account_name host endswith="EventCode=4625" | where eventcount>10

Ciao.

Giuseppe

Re: Search to count the number of failed logins since last successful login

jds2726 — Mon, 11 Jan 2021 17:11:15 GMT

This only seems to get me successful logon attempts that end with a failure, rater than a list of all logon failures that came after the most recent successful logon

Re: Search to count the number of failed logins since last successful login

gcusello — Mon, 11 Jan 2021 17:28:14 GMT

Hi @jds2726,

sorry!

yes the other EventCode:

index="[index name]" sourcetype=WinEventLog (EventCode=4624 OR EventCode=4625) | trasnsaction Account_name host endswith="EventCode=4624" | where eventcount>10

Ciao.

Giuseppe