Splunk Search

How to filter specific events from use case?

AidanMarkSmith
Observer

Hi All,

We have turned on the Use Case - ESCU 0365 Authentication Failures Alert

We need this turned on in order to assess risky logins, however due to the nature of the company (being a University) we have alot of old unused Alumni accounts that we cannot get rid of.

The issue we are running into is that the risk scores of some of these accounts are consistently rising causing a consistent volume of Highs. 

We have found that the accounts are trying to login via the user agent BAV2ROPC which is the Azure User Agent for Legacy Authentication (IMAP, POP3 etc)

We have tried adding these users to a conditional access policy in Azure to prevent these Authentication attempts but that has not worked.

The question I am asking is, is there any possible way in the Use Case search to specifically filter our BAV2ROPC so we do not constantly get these alerts as they are causing alot of noise within our search and it is making it difficult to find actual attempts to access users accounts.

This is our Correlation Search for this use case

index=appext_o365 `o365_management_activity` Workload=AzureActiveDirectory UserAuthenticationMethod=* status=failure | stats count earliest(_time) AS firstTime latest(_time) AS lastTime values(UserAuthenticationMethod) AS UserAuthenticationMethod values(UserAgent) AS UserAgent values(status) AS status values(src_ip) AS src_ip by user | where count > 10 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_excessive_authentication_failures_alert_filter`

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I should think it's a matter of testing the UserAgent value.

index=appext_o365 `o365_management_activity` Workload=AzureActiveDirectory UserAuthenticationMethod=* status=failure UserAgent!="BAV2ROPC"
| stats count earliest(_time) AS firstTime latest(_time) AS lastTime values(UserAuthenticationMethod) AS UserAuthenticationMethod values(UserAgent) AS UserAgent values(status) AS status values(src_ip) AS src_ip by user 
| where count > 10 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `o365_excessive_authentication_failures_alert_filter`
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...