Hello! I am building an alert to detect potential password spraying (it is looking for 10 or more failed logons within the last 15 minutes, where the username is correct but the password is wrong). It works well, however there is one issue. If the same user fails to login a lot then it will trigger the alert. I only want a failure to count if the usernames are different. For example, if one user fails to login 10 times it will NOT alert. If 10 different users fail to login once each then it would alert. Below is my syntax:   index=*-windows-logs EventCode=4625 signature="User name is correct but the password is wrong" Account_Name!=*$ | stats count by src_ip | where count > 10             ... View more

Hello! I am very interested in turning on Powershell logging in my environment and then sending those logs to Splunk. Any good recommendations for articles / URLs for me to start learning how to do this? Thx ... View more

Hello. I am creating a search to see when the Account_Name called "helpdesk" logs in via EventCode 4624 with Logon_Type=3. My goal is to see what source machines (src_nt_host) normally perform this logon behavior with that account name. After I find the source machines I will exclude them in the search so I can alert off of it. A search going back the past 3 months below brings back five different source machines (src_nt_host). Here is the strange part - when I exclude one of those five source machines using src_nt_host!=machineA then rerun the search, it brings back more source machines that never showed up in the original search! Any clue why this is occurring? It would be awesome if I could figure out what is going on! index=*-windows-logs (EventCode=4624 AND Logon_Type=3) Account_Name=helpdesk | sort - _time | table _time, Account_Name, EventCode, Logon_Type, src_nt_host, dest_nt_host, signature ... View more

I have setup an alert to run a search every 10 minutes which looks for a specific Event Code and a Message string. I want this to return results except for times between 12:30am and 1:30am. How can I do this? I tried the following below but it is not working: index=*-windows-logs EventCode=7036 Message="Service Entered A Running State" | sort - _time | eval myHour=strftime(_time, "%H") | eval myMinute=strftime(_time, "%M") | where NOT ( (myHour > 00 AND myMinute >30 ) AND (myHour <01 AND myMinute < 30) ) | table _time, ComputerName, Message ... View more