Correlation search for authentication event

[marco_massari11]

Hello,

I have to create a new correlation search looking for failed authentication to VPN. The rule should trigger if there are more than 5 login failures for a source IP and if there are 20 distinct source IPs with more than 80% login failures, at the moment I wrote the current query:

| tstats `summary_fillnull` values(Authentication.index) as index, values(sourcetype) as sourcetype, values(host) as host, values(Authentication.signature_id) as signature_id, count from datamodel=Authentication where NOT
[| `authentication_whitelist_generic`] nodename="Authentication.Failed_Authentication" by Authentication.src, Authentication.user, Authentication.dest, Authentication.Error_Code, Authentication.Sub_Status
| `drop_dm_object_name("Authentication")`
``` Error_Code and Sub_Status exclusions ```
| `windows_errorcode_substatus_exclusion`

Anyone has an idea on how to proceed?

Thanks in advance

[PickleRick]

Make two separate correlation searches. These are two separate conditions.

[yuanliu]

Assuming your search gives you some useful fields to make the determination based on some logic, the next step is to follow my Four Commandments of posing answerable questions in this forum:

• Illustrate data input (in raw text, anonymize as needed), whether they are raw events or output from a search that volunteers here do not have to look at.
• Illustrate the desired output from illustrated data.
• Explain the logic between illustrated data and desired output without SPL.
• If you also illustrate attempted SPL, illustrate actual output and compare with desired output, explain why they look different to you if that is not painfully obvious.