Multiple logins from the same IP.

[las]

I admit I have used limited time on this app so far but a quick question anyway.

When I have multiple failed logins from an IP, is it possible to get the usernames, that where used for these attempted logins?

[ahall_splunk · Accepted solution]

Yes - the data is in the logs. Just look for:

eventtype=msad-failed-user-logons src_ip="Your-IP"

... and it will give you the information you desire.