display results that happened in a 5 minute period during a 24hr search

[sdewar83]

Hi,

I have a failed logon search which includes:

| stats count by user, ComputerName
|search count >3 earliest=now() latest=-5m

Which shows me when a user has tried to log onto a particular box more than 3x in the last 5 minutes. I dont really want to be constantly running this search though!

Can anyone provide some pointers on how to do a search which shows more than 3x attempts within any 5 min period so that i could search a 24 hour period and it would display all the times users tried to logon to any given server more than 3x within a 5min period? Hopefully that makes sense!

I'm reading through the search reference, but i'm not really finding something that does the trick.

Appreciating any assistance.

[sdewar83 · Accepted solution]

in the end i've come up with something like:

(my search) 
|sort _time, user, ComputerName
| streamstats count time_window=5m by user, ComputerName
| Where count = 4
| table _time, user, ComputerName, EventCodeDescription

This seems to give me the result I want, i just need to do some further filtering so i can show what was failed attempts at interactive logons vs SMB logons etc.

[HiroshiSatoh]

You can easily replace the following search statement, although it may fall out of the condition.

(your search) earliest=now() latest=-24h
|bin span=5m
|stats count by _time, user, ComputerName
|search count >3

[sdewar83]

I'll give this a go and compare the results with what i came up with! thanks! 🙂