Alerting

Alert for Failed Login Attempts

drizzo
Path Finder

I have searched across Splunk Answers, Docs, and the YouTube channel, but I'm still having an issue with setting up a proper alert. I need to setup an Alert so that if failed logins exceeds 4 attempts within 10 minutes, an alert will be triggered. I went into the Search, typed:

index=* sourcetype="WinEventLog:Security" EventCode=4625 | stats count by host, Account_Name, name | where count > 4

The search is then saved as an Alert:

**Title:** <the name>
**Description:** <the description>
**Permissions:** Private
** Alert Type:** Real-time
**Trigger Alert when:** Per-Result
(No Throttling)

The issue is that it pulls results every five seconds. It seems that the system checks the log within my given time frame, notices that there are still logs, so triggers another alert. I then tried switching my search to:

index=* sourcetype="WinEventLog:Security" EventCode=4625 | stats count by host, Account_Name, name  

with the following Alert Type:

**Alert Type:** Real-time
**Trigger alert when:** Number of Results **is** greater than 4 *in* 10 minute(s)
**Trigger:** Once
(No Throttle)  

However, when I do that, it pulls up nothing. Any help would be appreciated, I've been stuck on this for two days.

0 Karma
1 Solution

horsefez
SplunkTrust
SplunkTrust

Hi drizzo,

ever tried "sheduled" instead of real-time before?

Do a Cron-Shedule and configure:

  earliest:  -10m@m
  latest:  @m
  cron expression:  */10 * * * *

View solution in original post

jcolon68
Explorer

What if you only wanted to check for maybe 4 particular accounts and not all?

0 Karma

ChrisG
Splunk Employee
Splunk Employee

Instead of ... | where count > 4, try ...| search count > 4 Or did you already try that?

drizzo
Path Finder

I just tested it out -- didn't work.

0 Karma

ChrisG
Splunk Employee
Splunk Employee

Then yes, I agree with pyro_wood that a scheduled alert, with throttling, is probably the way to go. Again, just to confirm: you have already read Configure alert trigger conditions and Throttle alerts in the Alerting Manual?

drizzo
Path Finder

I've not read the throttle alert ones. I'll take a gander. Thanks

0 Karma

horsefez
SplunkTrust
SplunkTrust

Hi drizzo,

ever tried "sheduled" instead of real-time before?

Do a Cron-Shedule and configure:

  earliest:  -10m@m
  latest:  @m
  cron expression:  */10 * * * *

drizzo
Path Finder

I just put it in. Still not working, but I'm going to quickly read up on Throttle Alerts to make sure I put in what you suggested correctly and that nothing else is interfering.

0 Karma

drizzo
Path Finder

This ended up working after I put in a throttle. Thanks for your help.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...