Security

How can I configure a password authentication failure alert?

alialbarwani
New Member

Hi there, I would like to configure Splunk to send an alert when password entry is incorrect 3 times. How can this be done?
Thanks in advance.

0 Karma

brian_rampley
Path Finder

I'm assuming you are wanting alerts when someone enters the wrong password trying to log into Splunk.

You can create the alert using SPL to search the internal Splunk logs. Here's a basic search, which can be added on as needed:

index=_internal component=UiAuth action=login status=failure

If you are wanting an alert for a failed logins on a system other than Splunk, then obviously you will need to collect those logs in Splunk and create a search for them.

Once you have your search, you can follow the directions in the splunk docs for creating an alert:
https://docs.splunk.com/Documentation/Splunk/latest/Alert/Aboutalerts

0 Karma

adonio
Ultra Champion

create a search that capture your condition,
click save as on the top right corner -> pick "alert" -> use the prompts to set up your alert
read here all the way for detailed information
https://docs.splunk.com/Documentation/Splunk/latest/Alert/Aboutalerts
hope it helps

0 Karma
Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...