Archive

Create Splunk Query aggregating failed log in events

Path Finder

I looking query where I can see the aggregation of failed log in events

Can you please share the query and details for how to see fail log in events

Tags (1)
0 Karma
1 Solution

Influencer

HI,

what kind of events do you have? splunk internal? windows event code?

for splunk : index=_audit action=failure | stats count by _time,user,action

for windows eventcode

index=yourindex
 sourcetype="WinEventLog:Security" 
 EventCode=4625
 |fillnull value=NULL
 | eval Account_Name = mvindex(Account_Name,1) 
 | eval Security_ID = mvindex(Security_ID,1) 
 | eval LoginType=case(Logon_Type=3,"RPC (not RDP)",Logon_Type=4,"Batch",Logon_Type=5,"Service",Logon_Type=7,"Screen Unlock/Session Resume",Logon_Type=10,"Remote Desktop",Logon_Type=11,"Cached",Logon_Type=9,"New Credentials")
 |stats count(Security_ID) as "Login Events" by Security_ID, Account_Name, LoginType,host,_time  |sort + Security_ID

View solution in original post

0 Karma

Influencer

HI,

what kind of events do you have? splunk internal? windows event code?

for splunk : index=_audit action=failure | stats count by _time,user,action

for windows eventcode

index=yourindex
 sourcetype="WinEventLog:Security" 
 EventCode=4625
 |fillnull value=NULL
 | eval Account_Name = mvindex(Account_Name,1) 
 | eval Security_ID = mvindex(Security_ID,1) 
 | eval LoginType=case(Logon_Type=3,"RPC (not RDP)",Logon_Type=4,"Batch",Logon_Type=5,"Service",Logon_Type=7,"Screen Unlock/Session Resume",Logon_Type=10,"Remote Desktop",Logon_Type=11,"Cached",Logon_Type=9,"New Credentials")
 |stats count(Security_ID) as "Login Events" by Security_ID, Account_Name, LoginType,host,_time  |sort + Security_ID

View solution in original post

0 Karma

Path Finder

Hello,

We have Windows Based events code , Thanks for the query let me verify and get back to you.

Thanks,
Sahil

0 Karma

Path Finder

hi,

Actually I need to check how to identify all technical accounts that are not automatically locked after 5 consecutive failed log in attempts, Is the above query will help to check failed log in events

Thanks,
Sahil

0 Karma

Influencer

Post a new question for that

0 Karma

Path Finder

Posted Help with the query

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!