the below search provides me info on failed logins for the past month, for example the last four fridays now i want to alert when a spike occurs for that day or any other day but i am lost at the where diff > any ideas? |tstats count values(Authentication.action) as Action from datamodel="Authentication" where (index=something Authentication.action="failure") by _time span=1day | eval week_day=strftime(_time,"%a")| sort week_day| streamstats current=f last(current) as prev by week_day | eval diff=abs(current-prev) | where diff > blahblah ... View more

I wanted to go over the following use case idea I had that I’ve been working. Basically, I am looking to gather abnormal failed authentications, for example thousands of failed attempts in a 5 minute period on any given day when normally we see many dozens. i am not getting expected results. Thanks. | tstats count values(Authentication.action) as Action, values(Authentication.user) as User, values(Authentication.src) as Source, values(Authentication.dest) as "dest" from datamodel="Authentication" where (index=acs Authentication.action!=success by Authentication.user | appendcols [| tstats count from datamodel=Authentication where Authentication.action=failure earliest=-30d latest=now by Authentication.user, _time span=5m | stats mean(count) as mean stdev(count) as stdev] | where count>mean+stdev ... View more

anyone have an idea on how to write up a search that will provide details on which logsource stopped reporting for the last 24 hours? ... View more

I am looking for network visibility into things such as IDS, firewalls, emails, ldap etc. ... View more

I want to add the number of events generated monthly to a dashboard. Any ideas on the search criteria needed for this request? ... View more

here is the start of my search but having issues figuring out the best way to capture the information i need. | tstats summariesonly=true values(All_Changes.result) as description from datamodel=Change_Analysis where index=wineventlog All_Changes.tag= audit All_Changes.tag!=stopped by All_Changes.src, All_Changes.result_id, All_Changes.change_type, All_Changes.action, All_Changes.status | rename All_Changes.* as * ... View more

I am not sure how to capture the device info associated with the MAC address? for example, apple device\mac address. I also want to capture the type of failure, for example Invalid Password or Wrong Password. The calling station id is the mac address of the device in question but i don't know how to capture the name, i am not looking for the name of the AP or WLC. Thanks. index=acs action=failure | stats count by user NetworkDeviceName "Calling_Station_ID" | rename "Calling_Station_ID" AS MAC | sort -count | where count > 100 ... View more

i am trying to get the client mac address that is connecting to our corporate wifi but i don't see a field called 'mac', i do see calling station and called station id but i am not sure if that is what i am looking for, any ideas? ... View more

I don't have proxy logs, but I do have ids/firewalls etc and I want to create a search that will identify when a user has downloaded tools such as nmap, kali etc. any ideas? ... View more

I have a rule that is not generating any splunk events when a user has been added/removed from my the AD groups created in CyberArk. I am not sure what i am missing. any ideas? ... View more

I am trying to identify when a member has been removed from security enabled groups such as domain admins, using index=wineventlog eventt_id=4729 but i am not finding anything with Group Name=Domain Admins? ... View more