Windows Failed Login Top Ten count

[aberdamy]

I am trying to get the top 10 Failed Login count by User. The problem is that Windows 2008 uses "Account_Name" and Windows 2003 uses "User_Name" so I've used eval to combine the two fields but I am also using rex to go to the second instance of the Account_Name in the Windows 2008 event. The rex expression doesn't seem to work when I throw eval in there. Below is my search string, any suggestions?

source="WinEventLog:Security" EventCode="4625" OR EventCode="529" |eval USER=coalesce(Account_Name,User_Name) | rex "(?ms)Account For Which Logon Failed.+?Account Name:\s+(?\V+)" |stats count by USER |sort -count |head 10

[aberdamy]

Solution:

source="WinEventLog:Security" EventCode="4625" OR EventCode="529" | rex field=_raw max_match=99 "Account Name:\s+(?\w+\$?)" | eval UserName=coalesce(User_Name,Account_Name) | stats count by UserName |sort -count |head 10

[aberdamy]

yes, appears to have worked. Of course, as you can see the rex has been changed as well

[somesoni2]

So max=99 in rex command did it?

[aberdamy]

Sorry I miss-typed that last one, the correct search string is below. I get results however it is missing the "4625" events. Conversely, if I rename as User_Name it does not include the "529" events

source="WinEventLog:Security" EventCode="4625" OR EventCode="529" | rex "(?ms)Account For Which Logon Failed.+?Account Name:s+(?V+)" |rename User_Name as Account_Name |stats count by Account_Name |sort -count |head 10

[aberdamy]

thank you for your reply, unfortunately putting |eval after rex did not work and using the rename function did not produce any results:

source="WinEventLog:Security" EventCode="4625" OR EventCode="529" | rex "(?ms)Account For Which Logon Failed.+?Account Name:s+(?V+)" |rename User_Name as Account_Name |stats count by USER |sort -count |head 10

[somesoni2]

Does the rex work if you don't use eval? If yes then you can try moving eval after rex.

Another option you can try is to that instead of eval USER, use '|rename User_Name as Account_Name | ...| stats count by Account_Name'.