Create Splunk Query aggregating failed log in events

[sahiltcs]

I looking query where I can see the aggregation of failed log in events

Can you please share the query and details for how to see fail log in events

[dkeck · Accepted solution]

HI,

what kind of events do you have? splunk internal? windows event code?

for splunk : index=_audit action=failure | stats count by _time,user,action

for windows eventcode

index=yourindex
 sourcetype="WinEventLog:Security" 
 EventCode=4625
 |fillnull value=NULL
 | eval Account_Name = mvindex(Account_Name,1) 
 | eval Security_ID = mvindex(Security_ID,1) 
 | eval LoginType=case(Logon_Type=3,"RPC (not RDP)",Logon_Type=4,"Batch",Logon_Type=5,"Service",Logon_Type=7,"Screen Unlock/Session Resume",Logon_Type=10,"Remote Desktop",Logon_Type=11,"Cached",Logon_Type=9,"New Credentials")
 |stats count(Security_ID) as "Login Events" by Security_ID, Account_Name, LoginType,host,_time  |sort + Security_ID

[sahiltcs]

Hello,

We have Windows Based events code , Thanks for the query let me verify and get back to you.

Thanks,
Sahil

[sahiltcs]

hi,

Actually I need to check how to identify all technical accounts that are not automatically locked after 5 consecutive failed log in attempts, Is the above query will help to check failed log in events

Thanks,
Sahil

[dkeck]

Post a new question for that

[sahiltcs]

Posted Help with the query