Search for recurring events over multiple time spans

neilsmith2 — Fri, 09 Dec 2022 12:34:50 GMT

Hi, looking for guidance please on how to alert on recurring auth events over multiple time spans, but I can't get my head around how to construct the search terms

for example:

- user account is locked out =>X per hour for =>X consecutive hours

- user has =>X login failures in an hour for =>X consecutive hours

Hope that makes sense! TIA

Re: Search for recurring events over multiple time spans

ITWhisperer — Fri, 09 Dec 2022 13:50:00 GMT

You can set up a report which counts the instances by the hour and then use something like streamstats to determine whether the hours with high counts are consecutive.

topic Search for recurring events over multiple time spans in Splunk Search

Search for recurring events over multiple time spans

Re: Search for recurring events over multiple time spans