Splunk Search

Splunk triggers an alert but shouldn't

ESIMatNeforce
Path Finder

Hello,

I have implemented an correlation search, where I want to find "Brute Force Behavior" and afterwards an "User was added to Domain Admins" Event with the following search:

(EventCode=4625 "bad password") OR (EventCode=4624 successfully Logon_Type=10) OR (EventCode=4728 "A member was added to a security-enabled*") | eval Account_Name=mvfilter(Account_Name!="-") | eval Account_Name = lower(Account_Name) | transaction Account_Name maxspan=2m endswith=(EventCode=4728 "A member was added to a security-enabled*") | where eventcount>=7

I have saved this search as an alert

When I test and do false logins followed by a real login this alert triggers (this alert shouldn't trigger at this moment because no member was added to a security-enabeld group") and I get an email notification. When I look up the alarm afterwards splunk does not find any result, as it should.

So why do I get an alarm when the search doesn't find anything? and does anyone know how to fix this issue?

best regards
ESIMatNeforce

0 Karma

LiquidTension
Path Finder

This might be way to simple, but is it possible that you have the alert condition set to "always" rather than something like "if number of events is greater that X"

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...