Alerting

Alert for Failed Login Attempts

drizzo
Path Finder

I have searched across Splunk Answers, Docs, and the YouTube channel, but I'm still having an issue with setting up a proper alert. I need to setup an Alert so that if failed logins exceeds 4 attempts within 10 minutes, an alert will be triggered. I went into the Search, typed:

index=* sourcetype="WinEventLog:Security" EventCode=4625 | stats count by host, Account_Name, name | where count > 4

The search is then saved as an Alert:

**Title:** <the name>
**Description:** <the description>
**Permissions:** Private
** Alert Type:** Real-time
**Trigger Alert when:** Per-Result
(No Throttling)

The issue is that it pulls results every five seconds. It seems that the system checks the log within my given time frame, notices that there are still logs, so triggers another alert. I then tried switching my search to:

index=* sourcetype="WinEventLog:Security" EventCode=4625 | stats count by host, Account_Name, name  

with the following Alert Type:

**Alert Type:** Real-time
**Trigger alert when:** Number of Results **is** greater than 4 *in* 10 minute(s)
**Trigger:** Once
(No Throttle)  

However, when I do that, it pulls up nothing. Any help would be appreciated, I've been stuck on this for two days.

0 Karma
1 Solution

horsefez
SplunkTrust
SplunkTrust

Hi drizzo,

ever tried "sheduled" instead of real-time before?

Do a Cron-Shedule and configure:

  earliest:  -10m@m
  latest:  @m
  cron expression:  */10 * * * *

View solution in original post

jcolon68
Explorer

What if you only wanted to check for maybe 4 particular accounts and not all?

0 Karma

ChrisG
Splunk Employee
Splunk Employee

Instead of ... | where count > 4, try ...| search count > 4 Or did you already try that?

drizzo
Path Finder

I just tested it out -- didn't work.

0 Karma

ChrisG
Splunk Employee
Splunk Employee

Then yes, I agree with pyro_wood that a scheduled alert, with throttling, is probably the way to go. Again, just to confirm: you have already read Configure alert trigger conditions and Throttle alerts in the Alerting Manual?

drizzo
Path Finder

I've not read the throttle alert ones. I'll take a gander. Thanks

0 Karma

horsefez
SplunkTrust
SplunkTrust

Hi drizzo,

ever tried "sheduled" instead of real-time before?

Do a Cron-Shedule and configure:

  earliest:  -10m@m
  latest:  @m
  cron expression:  */10 * * * *

View solution in original post

drizzo
Path Finder

I just put it in. Still not working, but I'm going to quickly read up on Throttle Alerts to make sure I put in what you suggested correctly and that nothing else is interfering.

0 Karma

drizzo
Path Finder

This ended up working after I put in a throttle. Thanks for your help.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!