How do you make a dashboard that checks multiple logins from user IP, failed IP and foreign IP?

[amarachijoy]

I want to design a design a a dashboard that will allow us to add a server to daily checks for logins from multiple ip users, multiple failed IP addresses and foreign IP addresses. Please, I will appreciate a well explained answer as i am still new to this .

Thanks

[mguhad]

You could run a search against the index where the server sits and filter through the IPs by using the | 'dedup' 'distinctcount'/dc command. i.e index=x sourcetype=myserver | chart dc(local_Ipaddresses)

You can simply replace (local_Ipaddresses) with the variable name of your foreign Ip address.

If you want to check failed logins... you can do something like: index=x sourcetype=myserver failed | chart dc(local_Ipaddresses)

the search above will give you all the unique IP addresses with failed login attemps. if you want to count how many login attempts they've made: index=x sourcetype=myserver failed | stats count by local_Ipaddresses

I hope this helps mate.

[whrg]

To clarify: You want to build one dashboard for one specific server?

[whrg]

@amarachijoy
I see you voted on my comment. Is that a yes to my question?
Also, could you tell us a little more about your data? Which fields (like src_ip,dest_port...) are available when searching for your data?