Filter brute force logins from Geographically Improbable Access

[bmorgenthaler]

In InfoSec App's Access Anomalies dashboard, the Geographically Improbable Access panel shows results from failed brute force logins. So for example I have a large number of common account names (admin, test, server, etc.) that do not exist in our environment and have failed logins into our perimeter systems showing up. Can this panel be configured to ONLY show known improbably access from successful logins and/or known users?

[igifrin_splunk · Accepted solution]

Thanks for pointing this out @bmorgenthaler. Yes, the Geographically Improbable Access table and the corresponding map should show only successful logins. This is now fixed and the fix will be available in the next version to be published on Splunkbase.

In the meantime, if anyone wants to update the searches manually, the first part of the search (before the second pipe) can be replaced with the following string that has where Authenication.action=success:

| tstats summariesonly=true allow_old_summaries=true values(Authentication.app) as app from datamodel=Authentication.Authentication where Authentication.action=success by Authentication.user, Authentication.src _time span=1s