Basic Brute Force Detection (Splunk Security Essentials)

[jamie1]

Hi There,

I am new to Splunk and have data coming in from just one server. I have tried running the basic brute force detection search, and receive thousands of events. I don't think this is accurate and thus feel as though I must have misconfigured something, somewhere. I'm not sure where I should begin to look.

Any help would be appreciated,

Jamie

[jamie1]

I also noticed an error: (Eventtype 'bd_Authentication-audit' does not exist or is disabled).