Splunk Search

Windows account lockout and enable- Why is my search returning 0 results?

debjit_k
Path Finder

Hi 

I want to create a splunk use case like a after getting 3 times failure the account again got enable.. 

I was working n below is my query but it is giving me 0 result can you please help me to modify the query 

 

source=WinEventLog:Security (EventCode=4625 OR EventCode=4624) | eval username=mvindex(Account_Name, 1) | streamstats count(eval(match(EventCode, "4625"))) as Failed, count(eval(match(EventCode, "4624"))) as Success reset_on_change=true by username | eval alert=if(Failed>3, "yes", "no") | where Failed > 3 | eval newname=username, newhost=host | where (Success > 1 AND host=newhost AND username=newname) | eval end_alert="YES" | table _time, username, host, Failed, Success, alert, newname, newhost, end_alert

 

Thanks 

Labels (5)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @debjit_k,

please try something like this:

index=wineventlog source=WinEventLog:Security (EventCode=4625 OR EventCode=4624) 
| eval username=mvindex(Account_Name, 1) 
| bin span=30m _time
| stats 
   count(eval(EventCode="4625")) AS Failed_count
   count(eval(EventCode="4624")) AS Success_count
   first(eval(if(EventCode="4624",strftime(_time,"%Y-%m-%d %H:%M:%S")." "."Success",""))) AS Success 
   values(eval(if(EventCode="4625",strftime(_time,"%Y-%m-%d %H:%M:%S")." "."Failed",""))) AS Failed
   earliest(_time) AS earliest
   latest(_time) AS latest
   by host username 
| eval alert=if(Failed_count>10, "more_fails", "no_more_fails") 
| where alert="more_fails" AND Success_count>0 AND latest-earliest<1800
| table _time username host Failed Failed_count Success alert

I cannot test this search, but it should work, please see the approach and eventually modify it if it doesn't run.

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @debjit_k,

your search isn't so correct, but anyway, are you sure to have some result?

then use always the index definition in the main search, so you'll have faster searches and you'll be sure that the index is correctly searched.

Anyway, please try something like this:

index=wineventlog source=WinEventLog:Security (EventCode=4625 OR EventCode=4624) 
| eval username=mvindex(Account_Name, 1) 
| stats 
   count(eval(EventCode="4625")) Failed
   count(eval(EventCode="4624")) as Success 
   by host username 
| eval alert=if(Failed>3, "more_fails", "no_more_fails") 
| where alert="more_fails" AND Success>1 
| table _time username host Failed Success alert

Ciao.

Giuseppe

debjit_k
Path Finder

Hi @gcusello 

I tried your query it is working I have one more question I want to keep like 10 unsuccess login within 30mins and it login 

 

Thanks 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @debjit_k,

you can insert the different trheeshold in the main search and manage the 30 minutes in the stats command:

index=wineventlog source=WinEventLog:Security (EventCode=4625 OR EventCode=4624) 
| eval username=mvindex(Account_Name, 1) 
| bin span=30m _time
| stats 
   count(eval(EventCode="4625")) AS Failed
   count(eval(EventCode="4624")) AS Success 
   earliest(_time) AS earliest
   latest(_time) AS latest
   by host username 
| eval alert=if(Failed>10, "more_fails", "no_more_fails") 
| where alert="more_fails" AND Success>1 AND latest-earliest<1800
| table _time username host Failed Success alert

Ciao.

Giuseppe

debjit_k
Path Finder

Hi @gcusello 

 

Thank you so much for your support just one last question I have in my mind.. 

While searching im getting first success full attempt followed by failed attempt but I want to see my failure followed by success.

For example 

10:02 failed 

10:03 failed...

10:35 success 

And I want only 1 successful attempt not multiple success but while running im getting 

Failure 61 success 12 But I want failure 61 and success==1 

 

Thanks 

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @debjit_k,

please try something like this:

index=wineventlog source=WinEventLog:Security (EventCode=4625 OR EventCode=4624) 
| eval username=mvindex(Account_Name, 1) 
| bin span=30m _time
| stats 
   count(eval(EventCode="4625")) AS Failed_count
   count(eval(EventCode="4624")) AS Success_count
   first(eval(if(EventCode="4624",strftime(_time,"%Y-%m-%d %H:%M:%S")." "."Success",""))) AS Success 
   values(eval(if(EventCode="4625",strftime(_time,"%Y-%m-%d %H:%M:%S")." "."Failed",""))) AS Failed
   earliest(_time) AS earliest
   latest(_time) AS latest
   by host username 
| eval alert=if(Failed_count>10, "more_fails", "no_more_fails") 
| where alert="more_fails" AND Success_count>0 AND latest-earliest<1800
| table _time username host Failed Failed_count Success alert

I cannot test this search, but it should work, please see the approach and eventually modify it if it doesn't run.

Ciao.

Giuseppe

debjit_k
Path Finder

Hi @gcusello 

Thank you I have change the query little bit as I was getting no successful attempt also in the table..
But little bit concern with the time span I gave very minimal time to test the query but it is not showing zero events 


For example 


index=sdp_siem_win source=WinEventLog:Security (EventCode=4625 OR EventCode=4624)
| eval username=mvindex(Account_Name, 1)
| stats
count(eval(EventCode="4625")) AS Failed_count
count(eval(EventCode="4624")) AS Success_count
first(eval(if(EventCode="4624",strftime(_time,"%Y-%m-%d %H:%M:%S")." "."Success",""))) AS Success
values(eval(if(EventCode="4625",strftime(_time,"%Y-%m-%d %H:%M:%S")." "."Failed",""))) AS Failed
earliest(_time) AS earliest
latest(_time) AS latest
by host username
| eval alert=if(Failed_count>5, "more_fails", "no_more_fails")
| where alert="more_fails" AND Success_count>0
| table username host Failed Failed_count Success alert
| search Success!=""

38D197BC-9213-4B28-A1A4-F89CC88A2AA0.jpeg

The above query showing the result but if I time time function then it is showing 0 result 

index=sdp_siem_win source=WinEventLog:Security (EventCode=4625 OR EventCode=4624)
| eval username=mvindex(Account_Name, 1)
| bin span=2m _time
| stats
count(eval(EventCode="4625")) AS Failed_count
count(eval(EventCode="4624")) AS Success_count
first(eval(if(EventCode="4624",strftime(_time,"%Y-%m-%d %H:%M:%S")." "."Success",""))) AS Success
values(eval(if(EventCode="4625",strftime(_time,"%Y-%m-%d %H:%M:%S")." "."Failed",""))) AS Failed
earliest(_time) AS earliest
latest(_time) AS latest
by host username
| eval alert=if(Failed_count>5, "more_fails", "no_more_fails")
| where alert="more_fails" AND Success_count>0 AND latest-earliest<120
| table username host Failed Failed_count Success alert
| search Success!=""

 

Can you please guide me where I get wrong 

Thanks 

 

0 Karma

debjit_k
Path Finder

Hi @gcusello 

Sorry for my inconvenience to you.. 

 

I'm looking like 

If (Last failed login)-(log in) is < 30 min it will triggered 

Suppose 

Last fail log in is 10:05 

Success full login at 10:25 

If the time gap between them is less than 30 mins then it should triggered and alert..

 

 

Thank

0 Karma

debjit_k
Path Finder

Hi @gcusello ,

 

While running your query im getting the below error 

Error in 'stats' command: You must specify a rename for the aggregation specifier on the dynamically evaluated field 'count(eval(EventCode="4625"))'.

Can you please guide me what's the issue 

Thanks

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @debjit_k,

sorry, I did a mistake, please try this:

index=wineventlog source=WinEventLog:Security (EventCode=4625 OR EventCode=4624) 
| eval username=mvindex(Account_Name, 1) 
| stats 
   count(eval(EventCode="4625")) AS Failed
   count(eval(EventCode="4624")) AS Success 
   by host username 
| eval alert=if(Failed>3, "more_fails", "no_more_fails") 
| where alert="more_fails" AND Success>1 
| table _time username host Failed Success alert

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...