In a search, how would one count the number of times a value appears in a defined time segment over a longer period of time?

[nickcardenas]

Hi everybody,

The search I'm trying to create is to alert possible brute force attacks using WindowEventLogs.

I'd like to have a search (alert) that runs every hour and splits that hour into 5 minute time blocks. For each of these time blocks, I'd like to have some logic to output to a table whenever there are "X" amount of failed attempts (or more) in ANY of the 12 five minute blocks within that hour.

I Imagine the results to look like this (X here is hypothetically 5):

User        Time       Count 
Bob         12:00        5
Alice       12:25        6
Steve       12:55       10

The current search I have written is:

basesearch sourcetype="WindowsEventLogs" eventCode=4265 etc. (with time picker set at "last 60minutes" )
| dedup _time user 
| bin _time span=5m 
| eventstats count by user
| search count > 5
| table user, time, count 

The result of this query yields me duplicates and an overall count of how many times a user failed a logon in the whole 60 minutes time range, rather than the count of how many times user fails a login in each of the 5min intervals.

I've searched all over and could appreciate some help! Thank you.

[richgalloway · Accepted solution]

Just a guess, but maybe using streamstats time_window=5m count by user instead of eventstats will help.

[nickcardenas]

Replacing this alone didn't fix the search, however, with streamstats I'm able to do a work around now! Adding streamstats to my search yielded me Time and users but with some duplicates, however, counting by these duplicates and user I'm able to yield exactly what I'm looking for. Thank you so much!