Search to count the number of failed logins since last successful login

[jds2726]

Hey everyone, I'm trying to write a search that will show the login events that occurred after the last successful logon event. So far I have this:

index="[index name]" sourcetype=WinEventLog "eventcode=4625" earliest=lastLogon | eval lastLogon=

where lastLogin = the time value of the last event from this search:

index="[index name]" sourcetype=WinEventLog "eventcode=4624"

Failed Logons: index="[index name]" sourcetype=WinEventLog "EventCode=4625"

Successful Logons: index="[index name]" sourcetype=WinEventLog "EventCode=4624"

Does anyone have an idea of how to evaluate this?

[gcusello]

Hi @jds2726,

you could use the transaction command bu it isn't very efficient (e.g. number of logfail >10):

index="[index name]" sourcetype=WinEventLog (EventCode=4624 OR EventCode=4625)
| trasnsaction Account_name host endswith="EventCode=4625"
| where eventcount>10 

 Ciao.

Giuseppe

[jds2726]

This only seems to get me successful logon attempts that end with a failure, rater than a list of all logon failures that came after the most recent successful logon

[gcusello]

Hi @jds2726,

sorry!

yes the other EventCode:

index="[index name]" sourcetype=WinEventLog (EventCode=4624 OR EventCode=4625)
| trasnsaction Account_name host endswith="EventCode=4624"
| where eventcount>10 

Ciao.

Giuseppe