Basic Brute Force Detection (Splunk Security Essen...

jamie1 · ‎03-22-2023

Hi There,

I am new to Splunk and have data coming in from just one server. I have tried running the basic brute force detection search, and receive thousands of events. I don't think this is accurate and thus feel as though I must have misconfigured something, somewhere. I'm not sure where I should begin to look.

Any help would be appreciated,

Jamie

jamie1 · ‎03-22-2023

I also noticed an error: (Eventtype 'bd_Authentication-audit' does not exist or is disabled).

Basic Brute Force Detection (Splunk Security Essentials)

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Accelerating Observability as Code with the Splunk AI Assistant

Join the Conversation

Basic Brute Force Detection (Splunk Security Essentials)

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Accelerating Observability as Code with the Splunk AI Assistant