Splunk Search

Splunk triggers an alert but shouldn't

ESIMatNeforce
Path Finder

Hello,

I have implemented an correlation search, where I want to find "Brute Force Behavior" and afterwards an "User was added to Domain Admins" Event with the following search:

(EventCode=4625 "bad password") OR (EventCode=4624 successfully Logon_Type=10) OR (EventCode=4728 "A member was added to a security-enabled*") | eval Account_Name=mvfilter(Account_Name!="-") | eval Account_Name = lower(Account_Name) | transaction Account_Name maxspan=2m endswith=(EventCode=4728 "A member was added to a security-enabled*") | where eventcount>=7

I have saved this search as an alert

When I test and do false logins followed by a real login this alert triggers (this alert shouldn't trigger at this moment because no member was added to a security-enabeld group") and I get an email notification. When I look up the alarm afterwards splunk does not find any result, as it should.

So why do I get an alarm when the search doesn't find anything? and does anyone know how to fix this issue?

best regards
ESIMatNeforce

0 Karma

LiquidTension
Path Finder

This might be way to simple, but is it possible that you have the alert condition set to "always" rather than something like "if number of events is greater that X"

Get Updates on the Splunk Community!

Set Up More Secure Configurations in Splunk Enterprise With Config Assist

This blog post is part 3 of 4 of a series on Splunk Assist. Click the links below to see the other ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Enterprise Security Content Update (ESCU) v3.54.0

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v3.54.0 and ...