Splunk Search

How to search for 3 failed logins followed by 1 successful login from one user to find brute force attacks?

Super Champion



The question is pretty straightforward. I would like to alert if 3 failed logins followed by 1 successful login from one user is observed.

For example:

1st minutexyzfailure
2nd minutexyzfailure
3rd minutexyzfailure
4th minutexyzsuccess


If this condition occurs.  I would like to create an alert. 

Thanks in advance

Labels (1)
0 Karma


Hi @mayurr98.

see @adonio 's answer to this question.


In addition, in Splunk Security Essentials App (https://splunkbase.splunk.com/app/3435/) you can find some Use cases already developed and here another answer (https://community.splunk.com/t5/All-Apps-and-Add-ons/Example-of-how-to-detect-basic-brute-force-atta...). 



0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Customer Survey!

If you use Splunk Observability Cloud, we invite you to share your valuable insights with us through a brief ...

Happy CX Day, Splunk Community!

Happy CX Day, Splunk Community! CX stands for Customer Experience, and today, October 3rd, is CX Day — a ...

.conf23 | Get Your Cybersecurity Defense Analyst Certification in Vegas

We’re excited to announce a new Splunk certification exam being released at .conf23! If you’re going to Las ...