Splunk Enterprise Security

Search for failed logins: Why is the search creating false positive alerts?



I have created a search for failed logins for win,linux and network devices from authentication datamodel but this is generating lot of false positive alerts. Please help me to finetune this search

| from datamodel:"Authentication"."Failed_Authentication" | search NOT user IN ("sam","sunil")
| stats values(signature) as signature, dc(user) as "user_count", dc(dest) as "dest_count" latest(_raw) as orig_raw, count by "app","src",user
| where 'count'>=200 AND user_count=1 | head 5




Labels (1)
Tags (2)
0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...