Splunk Search

Search to count the number of failed logins since last successful login

jds2726
Loves-to-Learn

Hey everyone, I'm trying to write a search that will show the login events that occurred after the last successful logon event. So far I have this:

index="[index name]" sourcetype=WinEventLog "eventcode=4625" earliest=lastLogon | eval lastLogon=

where lastLogin = the time value of the last event from this search:

index="[index name]" sourcetype=WinEventLog "eventcode=4624"

Failed Logons: index="[index name]" sourcetype=WinEventLog "EventCode=4625"

Successful Logons: index="[index name]" sourcetype=WinEventLog "EventCode=4624"

Does anyone have an idea of how to evaluate this?

Labels (2)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jds2726,

you could use the transaction command bu it isn't very efficient (e.g. number of logfail >10):

index="[index name]" sourcetype=WinEventLog (EventCode=4624 OR EventCode=4625)
| trasnsaction Account_name host endswith="EventCode=4625"
| where eventcount>10 

 Ciao.

Giuseppe

0 Karma

jds2726
Loves-to-Learn

This only seems to get me successful logon attempts that end with a failure, rater than a list of all logon failures that came after the most recent successful logon

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jds2726,

sorry!

yes the other EventCode:

index="[index name]" sourcetype=WinEventLog (EventCode=4624 OR EventCode=4625)
| trasnsaction Account_name host endswith="EventCode=4624"
| where eventcount>10 

Ciao.

Giuseppe 

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...