Multiple auth failures within a certain time frame

[helpmelearn]

Hello. 

Im trying to run a report that'll show me Multiple authenticatoin failures within a certain time frame. For example, 10 authentication failures within the space of 1 minute. Im trying to get the visualization right, to show me a table view per user that has failed 10 times within the space of a minute.  Also trying to get it to show day/time stamps too. Does anyone know how to do this? 

Thankyou

[helpmelearn]

Hello, 

Currently using : 

index="wineventlog"
| bin _time as minute span=10m
| streamstats count by _time
| eventstats count(eval(status="failed")) as failures by _user minute
| where failures > 5
| table user _time failures minute

But it is not bringing back any results, even if i increase the time span and decrease the failures to try to capture.

Im trying to also include that I want splunk to show me  if the same user fails to authenticate X amount of times within X minuites. Not just all users. But wanted splunk to show me per user if that makes sense?

Also i'm trying to get the results to show in a Table/statistics view, an example below: 

Time	Logon Account	action	Computer Name	Source Workstation	count
15/12/2021 08:00	joe.bloggs	failure	computer1	workstation1	22
15/12/2021 10:00	alex.hand	failure	computer1	workstation2	554
15/12/2021 12:25	bob.francis	failure	computer1	workstation3	75
15/12/2021 15:23	alice.green	failure	computer1	workstation4	42

So for example if I had it set to show me if there have been more than 5 auth fails within 5 minutes:

The Count column would show how many auth failures there were within the 5 minuites, and which user tried to authenticate. 

[helpmelearn]

Thankyou for the response

[helpmelearn]

Hello, 

For some reason its not bringing back anything. I have searched for: 

index="wineventlog"
| bin _time as minute span=20m
| eventstats count(eval(status="failed")) as failures by _user minute
| where failures > 0
| table user _time failures minute

As you can see ive searched for basically anything failing auths within a 20 minuite window, to try and catch something, but nothing is coming back. 

Cant think why though? 

[ITWhisperer]

Perhaps you could be a bit more specific - what is the exact search you are using and can you share some sample events? (Generic questions will get generic answers!)

[ITWhisperer]

| bin _time as minute span=1m
| eventstats count(eval(status="failed")) as failures by _user minute
| where failures > 10
| table user _time failures minute