Sticking to that example, I'd recommend letting existing authentication and authorization solutions tackle that. Most LDAP servers will block users after too many failed authentications, for example. I'm guessing you just used a simple example to illustrate things though... if the ruleset in general is way more complex, you could consider running the rules as often as you can - e.g. updating the number of failed authentications per user every ten minutes - and writing that decision out to a database. Then have the webapp talk to that database, e.g. "deny auth if table splunk_ruleset_blocked_users has an entry for that user within the last hour". Even with a truckload of hardware you're not going to achieve 50 splunk searches launched and completed within that second response time you've asked for. ... View more