Splunk Search

SPL Query Error

adoumbia
Engager

I am trying to write an spl query to detect an event of a single source IP address  or a user fails multiple time to login to multiple accounts.

can anyone help me write it.

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Please share some sample anonymised events so that we can see what you are dealing with. Please explain which parts of the events are important for what you are trying to discover. Please share what you would like the results to look like. Without this type of information, we are reduced to attempting to read your mind (and my mind-reading license has been revoked after the unfortunate incident with the estate agent!)

0 Karma

adoumbia
Engager

i want to find out which IP address, hostname or username has failed multiple time to login to multiple accounts.
I am trying to detect brute force attack.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @adoumbia ,

as @ITWhisperer said, it's really difficoult to help you without knowing the events to apply the search.

Anyway, if you need a brute force attack sample search, you can see in the Splunk Security Essentials App ( https://splunkbase.splunk.com/app/3435 ) where you can find what you're searching and many other Security Use Cases.

Ciao.

Giuseppe

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Please share some sample anonymised events so that we can see what you are dealing with. Please explain which parts of the events are important for what you are trying to discover. Please share what you would like the results to look like. Without this type of information, we are reduced to attempting to read your mind (and my mind-reading license has been revoked after the unfortunate incident with the estate agent!)

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...