Security

How to track users by IP address for failed login attempts?

splunker9999
Path Finder

Hi,

We need assistance in finding failed login attempts by IP address. This is because we received an alert for a failed login attempt for the "Admin" user.

Is there any way we can track the IP address from which it is accessed?

Thanks in advance.

0 Karma

jpolcari
Communicator

If this is a Windows environment, you can access failed login events (EventCode=4625) and look into the "Source_Network_Address" field. The IP address the user attempted to login from will be listed there.

index=wineventlog EventCode=4625
0 Karma

splunker9999
Path Finder

Hi, but this is not windows environment.

Thanks.

0 Karma

ppablo
Retired

Hi @splunker9999

Be sure to include all relevant information when you post your question. It's good to know it's not a Windows environment, but to save other users the trouble of assuming everything about your issue, can you please provide more details?

0 Karma
Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...