How to write a search to find an account that failed authentication more than 3 times in a 10 minute period?

[mmaier_splunk]

Hello,

i want to create a search that shows me when an account failed authentication of more than (3) times in a (10) minute period.

data structure:

tested:

tag=authentication sourcetype="juniper:sslvpn" | bin _time span=10m | stats count by user, _time | where count>3

however - that is only from 00:00 to 00:10, 00:10 - 00:20 and so on. it's not really a 10 minute period...

in my sample the last two events should have a count together of 2....

thanks for any help

[maciep]

maybe a good use case for autoregress or delta? Something like this (not really tested)?

tag=authentication sourcetype="juniper:sslvpn"
| sort 0 user _time
| autoregress _time as prev_time p=2
| autoregress user as prev_user p=2
| fillnull value=0
| eval diff = _time - prev_time
| where diff <= 600 AND user = prev_user
| table _time prev_time user prev_user diff
| convert ctime(prev_time)

[musskopf]

Have a look at the transaction command. You might be able to build a transaction on each user, where the maxspan=10m.

Here the link for the command reference: http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/Transaction

After that, just use the eventcount to evaluate the ones where are greater than 3. Here how I think it'll look:

tag=authentication sourcetype="juniper:sslvpn" | transacion user maxspan=10m | where eventcount>3 | table _time,user

Cheers

[triest]

For long periods of time, transaction tends to be more efficient then stream stats as after its 10m away, it knows it can quit tracking things.

With that said, somesoni2's answer could be simplified a bit and for shorter periods of time, it could perform better due to the overhead of the transaction command.

[somesoni2]

Give this a try

tag=authentication sourcetype="juniper:sslvpn" | table _time user | streamstats current=f window=1 first(_time) as prevTime by user| eval diff=coalesce(prevTime-_time,0) | streamstats current=t window=3 sum(diff) as duration count by user| where count=3 AND duration < 600 | stats count by user | table user