Security

How to write a search to find an account that failed authentication more than 3 times in a 10 minute period?

Splunk Employee
Splunk Employee

Hello,

i want to create a search that shows me when an account failed authentication of more than (3) times in a (10) minute period.

data structure:

alt text

tested:

tag=authentication sourcetype="juniper:sslvpn" | bin _time span=10m | stats count by user, _time | where count>3

however - that is only from 00:00 to 00:10, 00:10 - 00:20 and so on. it's not really a 10 minute period...

in my sample the last two events should have a count together of 2....

thanks for any help

0 Karma

Champion

maybe a good use case for autoregress or delta? Something like this (not really tested)?

tag=authentication sourcetype="juniper:sslvpn"
| sort 0 user time
| autoregress _time as prev
time p=2
| autoregress user as prevuser p=2
| fillnull value=0
| eval diff = _time - prev
time
| where diff <= 600 AND user = prevuser
| table _time prev
time user prevuser diff
| convert ctime(prev
time)

0 Karma

Builder

Have a look at the transaction command. You might be able to build a transaction on each user, where the maxspan=10m.

Here the link for the command reference: http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/Transaction

After that, just use the eventcount to evaluate the ones where are greater than 3. Here how I think it'll look:

tag=authentication sourcetype="juniper:sslvpn" | transacion user maxspan=10m | where eventcount>3 | table _time,user

Cheers

Communicator

For long periods of time, transaction tends to be more efficient then stream stats as after its 10m away, it knows it can quit tracking things.

With that said, somesoni2's answer could be simplified a bit and for shorter periods of time, it could perform better due to the overhead of the transaction command.

0 Karma

SplunkTrust
SplunkTrust

Give this a try

tag=authentication sourcetype="juniper:sslvpn" | table _time user | streamstats current=f window=1 first(_time) as prevTime by user| eval diff=coalesce(prevTime-_time,0) | streamstats current=t window=3 sum(diff) as duration count by user| where count=3 AND duration < 600 | stats count by user | table user