Splunk Search

Find results that are not in a transaction


The data is MFA attempts in O365. I have an alert that fires whenever someone denies an MFA push. The thing is, sometimes someone has just accidentally tapped "deny", and they use MFA successfully in the next minute or two.

Sample data:

2021-04-28 16:13:49SingleEVENT_CATEGORY_SSO_LOGIN
2021-04-28 16:13:46Multi-factorEVENT_CATEGORY_FACTOR_AUTH_SUCCESS
2021-04-28 16:13:43send_factor_verify_pushEVENT_CATEGORY_UNSPECIFIED
2021-04-28 16:13:38user.mfa.okta_verify.deny_pushEVENT_CATEGORY_UNSPECIFIED
2021-04-28 16:13:28send_factor_verify_pushEVENT_CATEGORY_UNSPECIFIED
2021-04-28 16:13:26LogEVENT_CATEGORY_LOGIN
2021-04-28 16:13:26policy.evaluate_sign_onEVENT_CATEGORY_UNSPECIFIED
2021-04-28 16:13:26message_sent.new_device_notificationEVENT_CATEGORY_UNSPECIFIED

What I want is to filter on messages that contain "deny_push", but that are not followed up with a successful authentication within 5 minutes after the deny_push event.

How on earth do I do that?

Labels (2)
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...