Security

Get failed login attempts from curl authentication

marone
Explorer

Hi I'm trying to get failed login from users who try to authenticate to Splunk using curl authentication, my command was
curl -k https://localhost:8089/services/auth/login --data-urlencode username=myUser --data-urlencode password=myWrongPass
and get an XML response saying that it's incorrect username or password, but when I enter valid credentials from this SPL search command :
index="_audit" action="login attempt" curl I only get successful authentication not failed ones. I'm interested to get a list of all failed logins who used curl.

Event result :
Audit:[timestamp=05-12-2020 16:11:55.106, user=myuser, action=login attempt, info=succeeded reason=user-initiated useragent="curl/7.69.1" clientip=127.0.0.1 session=3a7b3720876a61c93d1584b2b8613fe1][n/a]

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Splunk's audit log leaves a lot to be desired. What you seek, however, can be found elsewhere. Try index=_internal component=AuthenticationManagerSplunk.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Splunk's audit log leaves a lot to be desired. What you seek, however, can be found elsewhere. Try index=_internal component=AuthenticationManagerSplunk.

---
If this reply helps you, Karma would be appreciated.
0 Karma

marone
Explorer

Thanks it's working, but can I get some information about who's trying to login like IP address, machine name, etc. ?? im just getting a simple event :
05-12-2020 16:18:08.790 +0200 WARN AuthenticationManagerSplunk - Login failed. Incorrect login for user: myUser

0 Karma

richgalloway
SplunkTrust
SplunkTrust

That's as good as it gets.

---
If this reply helps you, Karma would be appreciated.
0 Karma

marone
Explorer

there is another workaround to get more information such as clientip, host, etc. by querying the api used in curl index=_internal uri="/services/auth/login", the information is logged in splunkd_access.log, and for ui failure authentications in splunk web are logged in splunkd_ui_access.log

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In September, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...