Splunk Search

How to search for 3 failed logins followed by 1 successful login from one user to find brute force attacks?

Super Champion



The question is pretty straightforward. I would like to alert if 3 failed logins followed by 1 successful login from one user is observed.

For example:

1st minutexyzfailure
2nd minutexyzfailure
3rd minutexyzfailure
4th minutexyzsuccess


If this condition occurs.  I would like to create an alert. 

Thanks in advance

Labels (1)
0 Karma

Esteemed Legend

Hi @mayurr98.

see @adonio 's answer to this question.


In addition, in Splunk Security Essentials App (https://splunkbase.splunk.com/app/3435/) you can find some Use cases already developed and here another answer (https://community.splunk.com/t5/All-Apps-and-Add-ons/Example-of-how-to-detect-basic-brute-force-atta...). 



0 Karma
Get Updates on the Splunk Community!

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! 🌈 In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...