topic SPL Query Error in Splunk Search

SPL Query Error

adoumbia — Wed, 27 Nov 2024 21:12:32 GMT

I am trying to write an spl query to detect an event of a single source IP address or a user fails multiple time to login to multiple accounts.

can anyone help me write it.

Re: SPL Query Error

ITWhisperer — Wed, 27 Nov 2024 21:18:14 GMT

Please share some sample anonymised events so that we can see what you are dealing with. Please explain which parts of the events are important for what you are trying to discover. Please share what you would like the results to look like. Without this type of information, we are reduced to attempting to read your mind (and my mind-reading license has been revoked after the unfortunate incident with the estate agent!)

Re: SPL Query Error

adoumbia — Wed, 27 Nov 2024 21:33:23 GMT

i want to find out which IP address, hostname or username has failed multiple time to login to multiple accounts.
I am trying to detect brute force attack.

Re: SPL Query Error

ITWhisperer — Wed, 27 Nov 2024 21:44:13 GMT

Re: SPL Query Error

gcusello — Thu, 28 Nov 2024 07:48:23 GMT

Hi @adoumbia ,

as @ITWhisperer said, it's really difficoult to help you without knowing the events to apply the search.

Anyway, if you need a brute force attack sample search, you can see in the Splunk Security Essentials App ( https://splunkbase.splunk.com/app/3435 ) where you can find what you're searching and many other Security Use Cases.

Ciao.

Giuseppe