Greetings,
It's been a while since I asked a question. I'm hoping someone can help out. I currently have a brute force alert for ssh attempts that looks for a total of five or more attempts of success or failure within five minutes, where at least four are failures and one is success. It runs every five minutes. Not perfect, but it does what I want. Now I want to do the same for Oracle logins. The ssh search looks like:
host=* sourcetype=linux_secure process=sshd ("tag::action"="success" OR "tag::action"="failure")
| stats count(action) as Attempts, count(eval(match(action,"failure"))) as Failed, count(eval(match(action,"success"))) as Success by user,src,host
| where Attempts>=5 AND Success>0 AND Failed>=5
| rename src as Source, user as User, host as Host
For Oracle though I need to look for four error codes:
0=Success
1017=Bad Password
28000=Account is Locked
1005=null password given; logon denied
So I want my search to look for at least four instances of 1017, 28000, or 1005 and at least once instance of 0. Is there a way to flag multiple error codes as "Failure" using the eval function similar to what I'm doing with the ssh search? Any advice would be appreciated.
My current search for a summary of failed logins over a 24 hour period is:
index=[my index] sourcetype="oracle:audit:trail" (RETURN_CODE!=0 OR RETURNCODE!=0)
| eval RETURNCODE=coalesce(RETURN_CODE, RETURNCODE)
| stats count by HOST, host, source, USERHOST, OS_USERNAME, USERNAME, RETURNCODE
| where count>7
| sort USERNAME, -count
| lookup oracle_codes.csv oracode as RETURNCODE OUTPUT message as RETURNCODE_DESC
| table HOST, USERHOST, OS_USERNAME, host, USERNAME, source, RETURNCODE, RETURNCODE_DESC, count
| WHERE RETURNCODE=1017 OR RETURNCODE=28000 OR RETURNCODE=1005
| rename HOST as "Source IP", host as "DB Hostname", USERNAME as "DB Username", source as "DB Audit Source", USERHOST as "User Hostname", OS_USERNAME as "User OS Username", RETURNCODE as "Error Code", RETURNCODE_DESC as "Error Description", count as "Error Count"
