Splunk Enterprise Security

How to get the results of a correlation search when we have success after login failures by user?

Path Finder

Hi All,

Below is the correlation search. I want the results for bruteforcesearch query only when we have successful login after failure attempts by user. The alert should trigger only if we have successful login after failure attempts and not when we only have failure attempts. Please help on the below.

| from datamodel:"Authentication"."Authentication" | stats values(tag) as tag,count(eval('action'=="failure")) as failure,count(eval('action'=="success")) as success by user app | search failure>10 success>0 | xswhere failure from failuresbysrccount1h in authentication is above medium

0 Karma

Path Finder

The below query does not work, though the timesuccess and timefailure is showing correctly but after using the where command it does not show any results even though it holds true.

| tstats values(Authentication.src) values(Authentication.dest) count
from datamodel=Authentication.Authentication
where Authentication.action=failure (Authentication.user!="ANONYMOUS LOGON")
by time, Authentication.user, Authentication.action
| search Authentication.user=Roshni.Hazra
| eval Time
failure=strftime(time,"%m/%D/%Y %m:%h:%s")
| union
[ tstats values(Authentication.src) values(Authentication.dest) count
from datamodel=Authentication.Authentication
where Authentication.action=success
by _time, Authentication.user, Authentication.action
| search Authentication.user=Roshni.Hazra
| eval Time
success=strftime(time,"%m/%D/%Y %m:%h:%s")]
| where Time
success>=Time_failure

0 Karma