Alerting

Alert for Failed Login Attempts

Path Finder

I have searched across Splunk Answers, Docs, and the YouTube channel, but I'm still having an issue with setting up a proper alert. I need to setup an Alert so that if failed logins exceeds 4 attempts within 10 minutes, an alert will be triggered. I went into the Search, typed:

index=* sourcetype="WinEventLog:Security" EventCode=4625 | stats count by host, Account_Name, name | where count > 4

The search is then saved as an Alert:

**Title:** <the name>
**Description:** <the description>
**Permissions:** Private
** Alert Type:** Real-time
**Trigger Alert when:** Per-Result
(No Throttling)

The issue is that it pulls results every five seconds. It seems that the system checks the log within my given time frame, notices that there are still logs, so triggers another alert. I then tried switching my search to:

index=* sourcetype="WinEventLog:Security" EventCode=4625 | stats count by host, Account_Name, name  

with the following Alert Type:

**Alert Type:** Real-time
**Trigger alert when:** Number of Results **is** greater than 4 *in* 10 minute(s)
**Trigger:** Once
(No Throttle)  

However, when I do that, it pulls up nothing. Any help would be appreciated, I've been stuck on this for two days.

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Hi drizzo,

ever tried "sheduled" instead of real-time before?

Do a Cron-Shedule and configure:

  earliest:  -10m@m
  latest:  @m
  cron expression:  */10 * * * *

View solution in original post

Explorer

What if you only wanted to check for maybe 4 particular accounts and not all?

0 Karma

Splunk Employee
Splunk Employee

Instead of ... | where count > 4, try ...| search count > 4 Or did you already try that?

Path Finder

I just tested it out -- didn't work.

0 Karma

Splunk Employee
Splunk Employee

Then yes, I agree with pyro_wood that a scheduled alert, with throttling, is probably the way to go. Again, just to confirm: you have already read Configure alert trigger conditions and Throttle alerts in the Alerting Manual?

Path Finder

I've not read the throttle alert ones. I'll take a gander. Thanks

0 Karma

SplunkTrust
SplunkTrust

Hi drizzo,

ever tried "sheduled" instead of real-time before?

Do a Cron-Shedule and configure:

  earliest:  -10m@m
  latest:  @m
  cron expression:  */10 * * * *

View solution in original post

Path Finder

I just put it in. Still not working, but I'm going to quickly read up on Throttle Alerts to make sure I put in what you suggested correctly and that nothing else is interfering.

0 Karma

Path Finder

This ended up working after I put in a throttle. Thanks for your help.

0 Karma