Security

Failed login alert issue

raghav013
New Member

We have a alert created in my orgainzation for failed login alerts, It is working fine but for last ttwo days we are getting excessive failed login alerts for a particular account on email as we have set to send the alert if the failed account is more that 10, it is working fine for other account and i am also able to see the failed login logs for all other accounts except this one which has more than 15000 failed login alerts.

Tags (2)
0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Okay, first, your organization needs to figure out what automated system is hitting that account and get that turned off.

Second, if you need a method to suppress alerts for this one account, you are going to have to modify the search/alert.

I would suggest you create a lookup table, here called "SuppressAlerts.csv", with a field (here called USER) containing the userID in question. We're going to assume the username field in the event is UserName.

At the end of your search, do this

| lookup SuppressAlerts.csv USER as UserName OUTPUT USER as SuppressMe
| where isnull(SuppressMe)

That will kill the one alert in question. You will need to set up some organizational method of reviewing the SuppressAlerts.csv lookup periodically to see if the suppression is still valid.

0 Karma

thambisetty
Super Champion

Whats your question here?
You have created an alert and its mached and creating alerts.

————————————
If this helps, give a like below.
0 Karma

YoungDaniel
Path Finder

alertception

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!