Logging Login Data of VM

[Jan21]

Hello,

i wanted to ask if there is a way in Splunk to collect failured Login Data from Users on a Virtual Machine that is hosted with VMware, so that i can see if a user tried to login like 5 times and failed the Login on VM 5 times? 

Would be nice to use it for finding out if there is some Kind of Brute Force Attack or something else going on.

[richgalloway · Accepted solution]

Yes, it is possible.  If the VM or identity provider logs failed logins to Splunk then you can search those events for multiple attempts within a given timeframe.

[Jan21]

But if the VM does not log those Data so far it is not possible?

[richgalloway]

Splunk cannot search what it doesn't have.