https://community.splunk.com/t5/Splunk-Search/create-a-query-for-brute-force/m-p/382087#M168020 <P>quick search in this portal will bring you many results:<BR /> <A href="https://answers.splunk.com/answers/368521/how-can-i-detect-a-successful-login-after-multiple.html">https://answers.splunk.com/answers/368521/how-can-i-detect-a-successful-login-after-multiple.html</A><BR /> <A href="https://answers.splunk.com/answers/556974/successful-bruteforce-login.html">https://answers.splunk.com/answers/556974/successful-bruteforce-login.html</A><BR /> <A href="https://answers.splunk.com/answers/553596/detect-successful-bruteforce-attacksuccessful-logi.html">https://answers.splunk.com/answers/553596/detect-successful-bruteforce-attacksuccessful-logi.html</A><BR /> <A href="https://answers.splunk.com/answers/336871/how-to-search-for-5-failed-logins-followed-by-1-su.html">https://answers.splunk.com/answers/336871/how-to-search-for-5-failed-logins-followed-by-1-su.html</A></P> <P>there are many more.</P> Wed, 01 Aug 2018 17:19:40 GMT adonio 2018-08-01T17:19:40Z https://community.splunk.com/t5/Splunk-Search/create-a-query-for-brute-force/m-p/382086#M168019 <P>I need to check which user accounts have had multiple login failures followed by a successful login</P> Wed, 01 Aug 2018 15:48:23 GMT https://community.splunk.com/t5/Splunk-Search/create-a-query-for-brute-force/m-p/382086#M168019 snigdhasaxena 2018-08-01T15:48:23Z https://community.splunk.com/t5/Splunk-Search/create-a-query-for-brute-force/m-p/382087#M168020 <P>quick search in this portal will bring you many results:<BR /> <A href="https://answers.splunk.com/answers/368521/how-can-i-detect-a-successful-login-after-multiple.html">https://answers.splunk.com/answers/368521/how-can-i-detect-a-successful-login-after-multiple.html</A><BR /> <A href="https://answers.splunk.com/answers/556974/successful-bruteforce-login.html">https://answers.splunk.com/answers/556974/successful-bruteforce-login.html</A><BR /> <A href="https://answers.splunk.com/answers/553596/detect-successful-bruteforce-attacksuccessful-logi.html">https://answers.splunk.com/answers/553596/detect-successful-bruteforce-attacksuccessful-logi.html</A><BR /> <A href="https://answers.splunk.com/answers/336871/how-to-search-for-5-failed-logins-followed-by-1-su.html">https://answers.splunk.com/answers/336871/how-to-search-for-5-failed-logins-followed-by-1-su.html</A></P> <P>there are many more.</P> Wed, 01 Aug 2018 17:19:40 GMT https://community.splunk.com/t5/Splunk-Search/create-a-query-for-brute-force/m-p/382087#M168020 adonio 2018-08-01T17:19:40Z