How do you manage an existing alert?

[johnsmithcy]

q1. How do you manage an existing alert?

q2. If I want to create an alert for when a Windows log is in fail, how do I make it? ( the search criteria is difficult to handle)

[johnsmithcy]

eventtype="wineventlog_common" source="inEventLog:" (host="" OR ComputerName="") TaskCategory="" SourceName="" EventCode="4625" Type="*" * TaskCategory="登入"

I saved above search code as alert , but no alert generated when "4625" event happended

[chrisyounger]

q1: You can find the alerts in your system by going to "Settings" > "Searches, Reports and Alerts". From this list, you should set Type, App and Owner filters to "All" so you can find your alerts. Now you can edit, enable and disable the alert.

To learn more about alerts, watch this quick youtube video made by the Splunk Education team:
https://www.youtube.com/watch?v=0REbozaALX0

q2: There is a sample search included in Splunk Security Essentials https://splunkbase.splunk.com/app/3435/ which has a basic search for detecting brute force login attempts. This is starting search you could try and use:

index=* (source=win*security OR sourcetype=linux_secure OR tag=authentication) user=* user!=""  
| stats count(eval(action="success")) as successes count(eval(action="failure")) as failures by src dest 
| where successes>0 AND failures>100

[dkeck]

HI,

1. To manage your existing alerts klick on settings->Searches, reports, and alerts-> set "Type" to Alert and app to "ALL"

2. For failed loggins have a look at this: http://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/56b36b4d3c44d86cf33341ca/1454598990...

Suggestion here is

index=windows LogName=Security EventCode=4625| table _time, Workstation_Name, Source_Network_Address, 
host, Account_Name

Also have a try with that, if the above is not enough

 index=yourindex
 sourcetype="WinEventLog:Security" 
 EventCode=4625
 |fillnull value=NULL
 | eval Account_Name = mvindex(Account_Name,1) 
 | eval Security_ID = mvindex(Security_ID,1) 
 | eval LoginType=case(Logon_Type=3,"RPC (not RDP)",Logon_Type=4,"Batch",Logon_Type=5,"Service",Logon_Type=7,"Screen Unlock/Session Resume",Logon_Type=10,"Remote Desktop",Logon_Type=11,"Cached",Logon_Type=9,"New Credentials")
 |stats count(Security_ID) as "Login Events" by Security_ID, Account_Name, LoginType,host,_time  |sort + Security_ID

[johnsmithcy]

eventtype="wineventlog_common" source="inEventLog:" (host="" OR ComputerName="") TaskCategory="" SourceName="" EventCode="4625" Type="" TaskCategory="登入"

I saved above search code as alert , but no alert generated when "4625" event happended