Security

Failed Logins followed by Success Corp Wifi?

ahmar74
Explorer

here is my string i just cant seem to figure out the x number of failures followed by success:

| tstats count values(Authentication.action) as Action, values(Authentication.user) as User, values(Authentication.Calling_Station_ID) as "MAC Address", values(Authentication.src) as Source from datamodel="Authentication"."Authentication" where (index=acs Authentication.action!=success Authentication.src!=10.242.*) by Authentication.user | brain freeze....

Tags (1)
0 Karma
1 Solution

mmontgomery_spl
Splunk Employee
Splunk Employee

There are a few ways, but I like this one as it is a little simpler to modify for other use cases as well:

| from datamodel:"Authentication"."Authentication" | stats values(user) values(Calling_Station_ID) count(eval('action'=="success")) as success, count(eval('action'=="failure")) as failure by src | search success>1 failure>20

View solution in original post

wenthold
Communicator

I don't think tstats is the way to go since you're analyzing data in aggregate. You might want to look at the answer Woodcock posted earlier: https://answers.splunk.com/answers/368521/how-can-i-detect-a-successful-login-after-multiple.html

You could approximate it with tstats, but I don't believe you can account for consecutive events using tstats with something like:

| tstats `summariesonly` count as failure_count from datamodel=Authentication where Authentication.action=failure earliest=-4h@h latest=-5m@m by Authentication.user, Authentication.app, _time
| join type=left Authentication.user, Authentication.app, _time  [| tstats `summariesonly` count as success_count from datamodel=Authentication where Authentication.action=success earliest=-4h@h latest=-5m@m by Authentication.user, Authentication.app, _time]
| where failure_count>3 and success_count>1

.. but this won't account for the sequence of events, it will only find where they occur together, and any sequence spanning one of the time periods won't properly be accounted for.

0 Karma

mmontgomery_spl
Splunk Employee
Splunk Employee

There are a few ways, but I like this one as it is a little simpler to modify for other use cases as well:

| from datamodel:"Authentication"."Authentication" | stats values(user) values(Calling_Station_ID) count(eval('action'=="success")) as success, count(eval('action'=="failure")) as failure by src | search success>1 failure>20
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...