Splunk Search

How to use Windows event logs to alert for the failed attempts less than 5 occurring for every hour?

kiran331
Builder

Slow and Low attack? How to use Windows event logs to alert for the failed attempts less than 5 occurring for every hour?

index=wineventlog  EventCode=4625
0 Karma

troyward
Explorer

Might consider using transactions.

index=wineventlog  EventCode=4625
| transaction <username field> maxspan=1h
| where eventcount < 5
| table <username> first last eventcount
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!