All Apps and Add-ons

Search for Single Source IP Address associated with Failed Logins for Multiple Accounts

New Member

We have an immediate need to create a Query that will Help Identify Password Spray Attempts:

I have been trying:

| stats by count src_ip, UserId | where count > 20

Unfortunately this doesn't work - What I need is a way to see

A Single IP Address associated with multiple UserIds or Account_Names

Could somebody be so kind as to help direct me to a relatively easy way to accomplish this task?

Thank You So Very Much

0 Karma



| stats dc(UserId) AS count_UserId, values(UserId) AS UserId BY src_ip | search count>20

This should show you src_ip values associated with more than 20 UserId values, and which UserId values they are.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 1 release of new security content via the ...

There's No Place Like Chrome and the Splunk Platform

Watch On DemandMalware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

The Great Resilience Quest: 5th Leaderboard Update

The fifth leaderboard update for The Great Resilience Quest is out >> 🏆 Check out the ...