Correlation Search for brute force

[toporagno]

HI,

I need to upgrade my correlation search for Excessive Failed Logins with Username,

| tstats summariesonly=true values("Authentication.tag") as "tag",dc("Authentication.user") as "user_count",values("Authentication.user") as "usernames", dc("Authentication.dest") as "dest_count",count from datamodel="Authentication"."Authentication" where nodename="Authentication.Failed_Authentication" by "Authentication.app","Authentication.src" | rename "Authentication.app" as "app","Authentication.src" as "src"  | where 'count'>=6

I would like the query to trigger only when there is a Successful Authentication after 6 failed authentication

thank youu

[PickleRick]

Apart from all the valid remarks from @gcusello and @richgalloway , think about what you need. If you want to build on the search shown by @gcusello notice that yours groups login attempts by source (which means that it will show multiple attempts to log in using different usernames but from the same IP as one result) whereas the other one groups by username which means that it will aggregate login attempts to the same account launched from different IPs but split different account login attempts from the same IP as separate results. So it's a question of what you are looking for.

[gcusello]

Hi @toporagno ,

as @richgalloway said, in Security Essentials App and in ES Content Updates App, there are many samples of the brute force attack followed by a saccessful login, anyway, you could ttry something like this:

| tstats summariesonly=true 
   count(eval(Authentication.action="success")) AS success_count 
   count(eval(Authentication.action="failure")) AS failure_count 
   FROM datamodel=Authentication 
   WHERE Authentication.action IN (success, failure)
   BY Authentication.user
| rename 
   Authentication.user AS user
| where failure_count>=6 AND success_count>=6

That you can adapt to your data.

Ciao.

Giuseppe

[richgalloway]

The current query can't do that because it only looks at failed logins.  It will never see a successful login.

The solution will entail appending a tstats command that counts successes and then modifying the where command to look for 6 or more failures and at least 1 success.

You can find an example in the Basic Brute Force Detection use case in the Splunk Security Essentials apps.