Alerting

Multisearch - Brute Force Attempts for both Linux and Windows

johnward4
Communicator

I am trying to create an alert to monitor for brute force attempt behavior for both linux and windows systems using a multisearch to stack my queries. I currently use the following query for Linux but do not have a goto windows alert that works and had a hard time finding one on answers...

Linux system Brute Force query :

sourcetype="linux_secure" process=sshd "password for" | rex field=_raw "(?<result>Accepted|Failed) password for (?<user>\w+) from (?<src>[0-9A-Fa-f:\.]+)" |eval success=if(result=="Failed",0,1), fail=if(result=="Failed",1,0) |stats range(_time) as range_secs sum(success) as success, sum(fail) as fail by host src |where fail!=0 |eval fail_rate_in_seconds=round(range_secs/fail,2) |where fail>10 AND success>0 | iplocation src |table host src success fail fail_rate_in_seconds Country
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi johnward4,
I suggest to use eventtype or tags:
create an eventtype for windows (e.g. win_log_fail tag=LOGFAIL)

index=wineventlog sourcetype=WinEventLog:Security (EventCode=4625 OR EventCode=529)

and an eventtype for linux (e.g. linux_log_fail tag=LOGFAIL)

index=linux sourcetype=linux "error: PAM: Authentication failure for "

so you can have in the same search both the results and you can count failures for each host without distinction between linux and windows:

tag=LOGFAIL
| ...

If you want to extract a field, you can do this for each sourcetype and then correlate them using coalesce function in eval command.

Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...