Splunk Search

Event correlation

fisk12
Path Finder

Hello I have begin try to build up splunk to use as an event handler. Ssh seemed to be a good place to start and learn, so im thinking of how to do it. As of now i was planning to create a custom dashboard that prints custom created events in realtime. Im now trying to create a event that search for a couple (3-4) of failed ssh logins on the same host in like 15 minutes.

How do i count the ammount of res=failed in a event that look like this?

index="os" source=/var/log/audit/audit.log res=failed | transaction host maxspan=15m 

Also, is this seem like a good idea to you?

Tags (1)
0 Karma

Paolo_Prigione
Builder

Hi, are you looking for failed logins associated to the same user name? If you have a field representing the user which attempted the login called "user_name", you could try the following to produce a table:

index="os" source=/var/log/audit/audit.log res=failed | bucket _time span=15m | stats count by _time host user_name | search count>=4

Or this one to plot a chart of the number of failed logins every 15 minutes, per host:

index="os" source=/var/log/audit/audit.log res=failed | timechart count by host

Welcome to the Splunk universe!

0 Karma

Paolo_Prigione
Builder

Event types are not suited to group set of related events. For instance, it would be hard (if not impossible) to create the event type "more than 4 failed login attempts". You could however create the event type "failed login attempt", and then a search counting those events per user in the last X minutes. Then you could create a simple dashboard with that and other searches in it, to monitor all the possible weird events in the infrastructure. (or schedule the searches and let them notify you when they find anything strange)

0 Karma

fisk12
Path Finder

Oh that was nice! My goal is to have a seperate dashboard/app (maybe a bit advanced atm) and there i have a list of "weird" event from the infrastructure. Stuff like multiples status=denied from the firewall, weird behaivior from someone browsing our homepage, denies from ssh etc. How do you that that in a smooth way?, maybe create the events and tag them, and have a search for taged events?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...