Splunk Search

SPL Query Error

adoumbia
Engager

I am trying to write an spl query to detect an event of a single source IP address  or a user fails multiple time to login to multiple accounts.

can anyone help me write it.

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Please share some sample anonymised events so that we can see what you are dealing with. Please explain which parts of the events are important for what you are trying to discover. Please share what you would like the results to look like. Without this type of information, we are reduced to attempting to read your mind (and my mind-reading license has been revoked after the unfortunate incident with the estate agent!)

0 Karma

adoumbia
Engager

i want to find out which IP address, hostname or username has failed multiple time to login to multiple accounts.
I am trying to detect brute force attack.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @adoumbia ,

as @ITWhisperer said, it's really difficoult to help you without knowing the events to apply the search.

Anyway, if you need a brute force attack sample search, you can see in the Splunk Security Essentials App ( https://splunkbase.splunk.com/app/3435 ) where you can find what you're searching and many other Security Use Cases.

Ciao.

Giuseppe

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Please share some sample anonymised events so that we can see what you are dealing with. Please explain which parts of the events are important for what you are trying to discover. Please share what you would like the results to look like. Without this type of information, we are reduced to attempting to read your mind (and my mind-reading license has been revoked after the unfortunate incident with the estate agent!)

0 Karma
Get Updates on the Splunk Community!

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...

From Alert to Resolution: How Splunk Observability Helps SREs Navigate Critical ...

It's 3:17 AM, and your phone buzzes with an urgent alert. Wire transfer processing times have spiked, and ...