Alerting
Highlighted

Splunk Alert based on threshold of failed logins within a specified time span

New Member

Splunk Gurus,

I am looking to build search that will identify any accounts that experience 5 failed login attempts within a 1 minute time span. The intent is to run a daily report highlight accounts with large amount of failures within a short period of time (potentially a bruteforce effort) for troubleshooting/customer service.

sourcetype=* result=FAILURE | table username, device, result, reason, src, "_time" | bucket _time span=1m | stats count by username, src | search count > 4
0 Karma
Highlighted

Re: Splunk Alert based on threshold of failed logins within a specified time span

Builder

Have you tried eventstats? Like so:

sourcetype=* result=FAILURE | bucket _time span=1m | eventstats count by username, src | search count > 4 | table username device result reason src _time count

View solution in original post

0 Karma
Highlighted

Re: Splunk Alert based on threshold of failed logins within a specified time span

New Member

I can definitely build on this, and really appreciate the help!

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.