How to search for 5 failed logins followed by 1 successful login from one user to find brute force attacks?

[sumit29]

Dear Experts,

Kindly help to create a search for 5 failed logins followed by 1 successful login from one user.

Interesting fields = user(Username) , action(Success Or Failed)

index=* | ....

Thanks in advanced

[miteshvohra]

In case, you are using the Common Information Model, then you can start your search as tag=Authentication. This will invoke the data from across all "relevant" indexes and will be much faster in returning results.

[Murali2888]

Hi sumit29,

Can you try the following?

index=* | stats list(Action) as Attempts, count(eval(match(Action,"Failed"))) as Failed, count(eval(match(Action,"Success"))) as Success by Username | where mvcount(Attempts)>=6 AND Success=1 AND Failed>=5

[thambisetty_bal]

HI Murali,

What if there would be multiple success events after 5 failed attempts? if that happens , success always will be greater than 1 then search returns 0 results. how to deal with this situation?

[lakshman239]

Thanks. That works.

[erdalcan]

That does seem to work, but it doesn't take the time sequence in consideration , how can I order the events in order of time? I first want to see 5 failed loggings followed by a successful login, and not 6 total loggings where there is a successful login in between somewhere

[lakshman239]

In how many mins, do you want to see the failed login followed by successful logon? if you schedule the above search within that time frame, it should help in you in what you need. Alternatively, you could also use streamstats to get the running total for a given period.

[erdalcan]

I have already added a time field (10 minutes), but it seems this query searches in the given timeframe and looks for the total failed and one successful event, without taking the time sequence in which order they came.
for example, I run the query and see users who have logged in this sequence:
1. failure
2. success
3. failure
4. failure
5. failure
6. failure

The query should only look for the first 5 failed loggings followed by a successful, but
it looks in total of loggings within a timeframe

wonder if this is easy to do with the enterprise security app, there you do have brute force queries but none of them contain the successful brute force attacks