Other Usage

Multiple auth failures within a certain time frame

helpmelearn
Explorer

Hello. 

 

Im trying to run a report that'll show me Multiple authenticatoin failures within a certain time frame. For example, 10 authentication failures within the space of 1 minute. Im trying to get the visualization right, to show me a table view per user that has failed 10 times within the space of a minute.  Also trying to get it to show day/time stamps too. Does anyone know how to do this? 

 

Thankyou

 

 

Labels (3)
0 Karma

helpmelearn
Explorer

Hello, 

Currently using : 

index="wineventlog"
| bin _time as minute span=10m
| streamstats count by _time
| eventstats count(eval(status="failed")) as failures by _user minute
| where failures > 5
| table user _time failures minute

But it is not bringing back any results, even if i increase the time span and decrease the failures to try to capture.

Im trying to also include that I want splunk to show me  if the same user fails to authenticate X amount of times within X minuites. Not just all users. But wanted splunk to show me per user if that makes sense?

Also i'm trying to get the results to show in a Table/statistics view, an example below: 

TimeLogon AccountactionComputer NameSource Workstationcount
15/12/2021 08:00joe.bloggsfailurecomputer1 workstation122
15/12/2021 10:00alex.handfailurecomputer1 workstation2554
15/12/2021 12:25bob.francisfailurecomputer1 workstation375
15/12/2021 15:23alice.greenfailurecomputer1 workstation442

 

So for example if I had it set to show me if there have been more than 5 auth fails within 5 minutes:

The Count column would show how many auth failures there were within the 5 minuites, and which user tried to authenticate. 

 

0 Karma

helpmelearn
Explorer

Thankyou for the response

0 Karma

helpmelearn
Explorer

Hello, 

For some reason its not bringing back anything. I have searched for: 

index="wineventlog"
| bin _time as minute span=20m
| eventstats count(eval(status="failed")) as failures by _user minute
| where failures > 0
| table user _time failures minute

As you can see ive searched for basically anything failing auths within a 20 minuite window, to try and catch something, but nothing is coming back. 

Cant think why though? 

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Perhaps you could be a bit more specific - what is the exact search you are using and can you share some sample events? (Generic questions will get generic answers!)

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| bin _time as minute span=1m
| eventstats count(eval(status="failed")) as failures by _user minute
| where failures > 10
| table user _time failures minute
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...