Security

How to write a search to find an account that failed authentication more than 3 times in a 10 minute period?

mmaier_splunk
Splunk Employee
Splunk Employee

Hello,

i want to create a search that shows me when an account failed authentication of more than (3) times in a (10) minute period.

data structure:

alt text

tested:

tag=authentication sourcetype="juniper:sslvpn" | bin _time span=10m | stats count by user, _time | where count>3

however - that is only from 00:00 to 00:10, 00:10 - 00:20 and so on. it's not really a 10 minute period...

in my sample the last two events should have a count together of 2....

thanks for any help

0 Karma

maciep
Champion

maybe a good use case for autoregress or delta? Something like this (not really tested)?

tag=authentication sourcetype="juniper:sslvpn"
| sort 0 user _time
| autoregress _time as prev_time p=2
| autoregress user as prev_user p=2
| fillnull value=0
| eval diff = _time - prev_time
| where diff <= 600 AND user = prev_user
| table _time prev_time user prev_user diff
| convert ctime(prev_time)

0 Karma

musskopf
Builder

Have a look at the transaction command. You might be able to build a transaction on each user, where the maxspan=10m.

Here the link for the command reference: http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/Transaction

After that, just use the eventcount to evaluate the ones where are greater than 3. Here how I think it'll look:

tag=authentication sourcetype="juniper:sslvpn" | transacion user maxspan=10m | where eventcount>3 | table _time,user

Cheers

triest
Communicator

For long periods of time, transaction tends to be more efficient then stream stats as after its 10m away, it knows it can quit tracking things.

With that said, somesoni2's answer could be simplified a bit and for shorter periods of time, it could perform better due to the overhead of the transaction command.

0 Karma

somesoni2
Revered Legend

Give this a try

tag=authentication sourcetype="juniper:sslvpn" | table _time user | streamstats current=f window=1 first(_time) as prevTime by user| eval diff=coalesce(prevTime-_time,0) | streamstats current=t window=3 sum(diff) as duration count by user| where count=3 AND duration < 600 | stats count by user | table user
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...