Alerting

Create an alert for account login fails at a certain amount of times within a certain time

Explorer

I'd like some ideas on alerting when an Active Directory account has a particular # of login failures within a particular amount of time. The premise is to try and send an alert on an account that is about to get locked out.

0 Karma
1 Solution

Splunk Employee
Splunk Employee

Is this what you are looking for?

sourcetype="WinEventLog:Security" EventCode=4625 earliest=-15m@m 
| eval userfield=mvindex(Account_Name,1) 
| stats count as failedlogins by userfield 
| where failedlogins > 4

I did the userfield extraction because Account_Name is usually a multivalued field. My demo data has a - in there. To change the time window, modify the earliest=-15m@m in the first line. To change the threshold, modify the where clause.

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

Is this what you are looking for?

sourcetype="WinEventLog:Security" EventCode=4625 earliest=-15m@m 
| eval userfield=mvindex(Account_Name,1) 
| stats count as failedlogins by userfield 
| where failedlogins > 4

I did the userfield extraction because Account_Name is usually a multivalued field. My demo data has a - in there. To change the time window, modify the earliest=-15m@m in the first line. To change the threshold, modify the where clause.

View solution in original post

0 Karma

Explorer

This is great! Thanks! what if I just wanted to monitor a couple of specific acccounts?

0 Karma

Splunk Employee
Splunk Employee

Then you could filter it in the where clause:

| where failedlogins > 4 AND userfield in ("user1","user2")
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!