Getting Data In

Windows Failed Login Top Ten count

aberdamy
Explorer

I am trying to get the top 10 Failed Login count by User. The problem is that Windows 2008 uses "Account_Name" and Windows 2003 uses "User_Name" so I've used eval to combine the two fields but I am also using rex to go to the second instance of the Account_Name in the Windows 2008 event. The rex expression doesn't seem to work when I throw eval in there. Below is my search string, any suggestions?

source="WinEventLog:Security" EventCode="4625" OR EventCode="529" |eval USER=coalesce(Account_Name,User_Name) | rex "(?ms)Account For Which Logon Failed.+?Account Name:\s+(?\V+)" |stats count by USER |sort -count |head 10

0 Karma

aberdamy
Explorer

Solution:

source="WinEventLog:Security" EventCode="4625" OR EventCode="529" | rex field=_raw max_match=99 "Account Name:\s+(?\w+\$?)" | eval UserName=coalesce(User_Name,Account_Name) | stats count by UserName |sort -count |head 10

aberdamy
Explorer

yes, appears to have worked. Of course, as you can see the rex has been changed as well

0 Karma

somesoni2
Revered Legend

So max=99 in rex command did it?

0 Karma

aberdamy
Explorer

Sorry I miss-typed that last one, the correct search string is below. I get results however it is missing the "4625" events. Conversely, if I rename as User_Name it does not include the "529" events

source="WinEventLog:Security" EventCode="4625" OR EventCode="529" | rex "(?ms)Account For Which Logon Failed.+?Account Name:s+(?V+)" |rename User_Name as Account_Name |stats count by Account_Name |sort -count |head 10

0 Karma

aberdamy
Explorer

thank you for your reply, unfortunately putting |eval after rex did not work and using the rename function did not produce any results:

source="WinEventLog:Security" EventCode="4625" OR EventCode="529" | rex "(?ms)Account For Which Logon Failed.+?Account Name:s+(?V+)" |rename User_Name as Account_Name |stats count by USER |sort -count |head 10

0 Karma

somesoni2
Revered Legend

Does the rex work if you don't use eval? If yes then you can try moving eval after rex.

Another option you can try is to that instead of eval USER, use '|rename User_Name as Account_Name | ...| stats count by Account_Name'.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!