Alerting

Create an alert for account login fails at a certain amount of times within a certain time

jcolon68
Explorer

I'd like some ideas on alerting when an Active Directory account has a particular # of login failures within a particular amount of time. The premise is to try and send an alert on an account that is about to get locked out.

0 Karma
1 Solution

kmorris_splunk
Splunk Employee
Splunk Employee

Is this what you are looking for?

sourcetype="WinEventLog:Security" EventCode=4625 earliest=-15m@m 
| eval userfield=mvindex(Account_Name,1) 
| stats count as failedlogins by userfield 
| where failedlogins > 4

I did the userfield extraction because Account_Name is usually a multivalued field. My demo data has a - in there. To change the time window, modify the earliest=-15m@m in the first line. To change the threshold, modify the where clause.

View solution in original post

0 Karma

kmorris_splunk
Splunk Employee
Splunk Employee

Is this what you are looking for?

sourcetype="WinEventLog:Security" EventCode=4625 earliest=-15m@m 
| eval userfield=mvindex(Account_Name,1) 
| stats count as failedlogins by userfield 
| where failedlogins > 4

I did the userfield extraction because Account_Name is usually a multivalued field. My demo data has a - in there. To change the time window, modify the earliest=-15m@m in the first line. To change the threshold, modify the where clause.

0 Karma

jcolon68
Explorer

This is great! Thanks! what if I just wanted to monitor a couple of specific acccounts?

0 Karma

kmorris_splunk
Splunk Employee
Splunk Employee

Then you could filter it in the where clause:

| where failedlogins > 4 AND userfield in ("user1","user2")
0 Karma
Get Updates on the Splunk Community!

Splunk is Nurturing Tomorrow’s Cybersecurity Leaders Today

Meet Carol Wright. She leads the Splunk Academic Alliance program at Splunk. The Splunk Academic Alliance ...

Part 2: A Guide to Maximizing Splunk IT Service Intelligence

Welcome to the second segment of our guide. In Part 1, we covered the essentials of getting started with ITSI ...

Part 1: A Guide to Maximizing Splunk IT Service Intelligence

As modern IT environments continue to grow in complexity and speed, the ability to efficiently manage and ...