Security

Get failed login attempts from curl authentication

marone
Explorer

Hi I'm trying to get failed login from users who try to authenticate to Splunk using curl authentication, my command was
curl -k https://localhost:8089/services/auth/login --data-urlencode username=myUser --data-urlencode password=myWrongPass
and get an XML response saying that it's incorrect username or password, but when I enter valid credentials from this SPL search command :
index="_audit" action="login attempt" curl I only get successful authentication not failed ones. I'm interested to get a list of all failed logins who used curl.

Event result :
Audit:[timestamp=05-12-2020 16:11:55.106, user=myuser, action=login attempt, info=succeeded reason=user-initiated useragent="curl/7.69.1" clientip=127.0.0.1 session=3a7b3720876a61c93d1584b2b8613fe1][n/a]

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Splunk's audit log leaves a lot to be desired. What you seek, however, can be found elsewhere. Try index=_internal component=AuthenticationManagerSplunk.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Splunk's audit log leaves a lot to be desired. What you seek, however, can be found elsewhere. Try index=_internal component=AuthenticationManagerSplunk.

---
If this reply helps you, Karma would be appreciated.
0 Karma

marone
Explorer

Thanks it's working, but can I get some information about who's trying to login like IP address, machine name, etc. ?? im just getting a simple event :
05-12-2020 16:18:08.790 +0200 WARN AuthenticationManagerSplunk - Login failed. Incorrect login for user: myUser

0 Karma

richgalloway
SplunkTrust
SplunkTrust

That's as good as it gets.

---
If this reply helps you, Karma would be appreciated.
0 Karma

marone
Explorer

there is another workaround to get more information such as clientip, host, etc. by querying the api used in curl index=_internal uri="/services/auth/login", the information is logged in splunkd_access.log, and for ui failure authentications in splunk web are logged in splunkd_ui_access.log

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...