topic Re: Tracking failed logins followed by successful logins using the transaction command in Splunk Search

Tracking failed logins followed by successful logins using the transaction command

My — Mon, 29 Nov 2021 02:25:02 GMT

Hello,

I am trying to track failed logons followed by a successful one using the transaction command and the following criteria:

Limit the time span to 5 min, add a startswith so each transaction will begin with a logon failure, add an endswith so each transaction will end with logon success and add a | where to find when the eventcount exceeds 3

this is what I have so far

Re: Tracking failed logins followed by successful logins using the transaction command

rrovers — Mon, 29 Nov 2021 08:57:46 GMT

I don't see what's wrong with this, except that I don't understand the "where eventcount >3". Without that I expect that it should give you the right results. Or what is it exactly that you are missing?

Re: Tracking failed logins followed by successful logins using the transaction command

gcusello — Mon, 29 Nov 2021 09:08:03 GMT

Hi @My,

I don't like transaction command and I use it only when I haven't any other solution.

In your case, you could do this:

index=wineventlog sourcetype=xmlwineventlog:Security EventCode IN (4624,4625) | stats dc(EventCode) AS dc_eventcode count(eval(EventCode=4625)) AS failed BY user host | where dc_eventcode>1 AND failed>5

in this way you have the filter for more than 5 failed logins and a successful login grouped for user and host.

Ciao.

Giuseppe