Security

Get failed login attempts from curl authentication

marone
Explorer

Hi I'm trying to get failed login from users who try to authenticate to Splunk using curl authentication, my command was
curl -k https://localhost:8089/services/auth/login --data-urlencode username=myUser --data-urlencode password=myWrongPass
and get an XML response saying that it's incorrect username or password, but when I enter valid credentials from this SPL search command :
index="_audit" action="login attempt" curl I only get successful authentication not failed ones. I'm interested to get a list of all failed logins who used curl.

Event result :
Audit:[timestamp=05-12-2020 16:11:55.106, user=myuser, action=login attempt, info=succeeded reason=user-initiated useragent="curl/7.69.1" clientip=127.0.0.1 session=3a7b3720876a61c93d1584b2b8613fe1][n/a]

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Splunk's audit log leaves a lot to be desired. What you seek, however, can be found elsewhere. Try index=_internal component=AuthenticationManagerSplunk.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Splunk's audit log leaves a lot to be desired. What you seek, however, can be found elsewhere. Try index=_internal component=AuthenticationManagerSplunk.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

marone
Explorer

Thanks it's working, but can I get some information about who's trying to login like IP address, machine name, etc. ?? im just getting a simple event :
05-12-2020 16:18:08.790 +0200 WARN AuthenticationManagerSplunk - Login failed. Incorrect login for user: myUser

0 Karma

richgalloway
SplunkTrust
SplunkTrust

That's as good as it gets.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

marone
Explorer

there is another workaround to get more information such as clientip, host, etc. by querying the api used in curl index=_internal uri="/services/auth/login", the information is logged in splunkd_access.log, and for ui failure authentications in splunk web are logged in splunkd_ui_access.log

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...