Splunk Enterprise

Splunk Account Lockout

OsmanElyas
Explorer

I have just configured Splunk and I have alert running for locked account.

It keep generating multiple entries from per lockout account 

So I want to generate one message incase of account get locked

 

index=wineventlog source="WinEventLog:Security" sourcetype=WinEventLog action=failure Account_Name="*" user="*" AND "taskcategory=Account Lockout"

Labels (1)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

What you want is to throttle the alert.  Throttling prevents the alert from firing too often.  To turn on throttling, edit the alert and check the box labled "Thottle" then specify how long you want Splunk to wait before firing the alert again.

---
If this reply helps you, Karma would be appreciated.
0 Karma

OsmanElyas
Explorer

@richgalloway  Thank you for the guide I am still facing small issue 

what should be in the filed Suppress results containing field value when I click on throttle.

 

 
Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Use a field name that uniquely identifies the specific alert you wish to throttle.  In this case, that field would be Account_Name since you don't want repeated alerts for users.

---
If this reply helps you, Karma would be appreciated.
0 Karma

OsmanElyas
Explorer

@richgalloway  Much appreciate your support, I have implemented the report.

richgalloway
SplunkTrust
SplunkTrust

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Level Up Your .conf25: Splunk Arcade Comes to Boston

With .conf25 right around the corner in Boston, there’s a lot to look forward to — inspiring keynotes, ...

Manual Instrumentation with Splunk Observability Cloud: How to Instrument Frontend ...

Although it might seem daunting, as we’ve seen in this series, manual instrumentation can be straightforward ...

Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform

 Are you ready to revolutionize your IT operations? As digital transformation accelerates, the demand for ...