Security

Get failed login attempts from curl authentication

marone
Explorer

Hi I'm trying to get failed login from users who try to authenticate to Splunk using curl authentication, my command was
curl -k https://localhost:8089/services/auth/login --data-urlencode username=myUser --data-urlencode password=myWrongPass
and get an XML response saying that it's incorrect username or password, but when I enter valid credentials from this SPL search command :
index="_audit" action="login attempt" curl I only get successful authentication not failed ones. I'm interested to get a list of all failed logins who used curl.

Event result :
Audit:[timestamp=05-12-2020 16:11:55.106, user=myuser, action=login attempt, info=succeeded reason=user-initiated useragent="curl/7.69.1" clientip=127.0.0.1 session=3a7b3720876a61c93d1584b2b8613fe1][n/a]

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Splunk's audit log leaves a lot to be desired. What you seek, however, can be found elsewhere. Try index=_internal component=AuthenticationManagerSplunk.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Splunk's audit log leaves a lot to be desired. What you seek, however, can be found elsewhere. Try index=_internal component=AuthenticationManagerSplunk.

---
If this reply helps you, Karma would be appreciated.
0 Karma

marone
Explorer

Thanks it's working, but can I get some information about who's trying to login like IP address, machine name, etc. ?? im just getting a simple event :
05-12-2020 16:18:08.790 +0200 WARN AuthenticationManagerSplunk - Login failed. Incorrect login for user: myUser

0 Karma

richgalloway
SplunkTrust
SplunkTrust

That's as good as it gets.

---
If this reply helps you, Karma would be appreciated.
0 Karma

marone
Explorer

there is another workaround to get more information such as clientip, host, etc. by querying the api used in curl index=_internal uri="/services/auth/login", the information is logged in splunkd_access.log, and for ui failure authentications in splunk web are logged in splunkd_ui_access.log

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...