How to search failed login attempts of a user in Siteminder smaccess.log and alert after the 3rd unsuccessful login attempt?

[krishnacasso]

Need to develop a dashboard and a report for getting the the user information of who tried to log in and failed. Need to get an alert after the 3rd unsuccessful login attempt.

Thanks.

[lguinn2 · Accepted solution]

The following search will give you a list of user names (CN) that have more than 2 failed logins.

sourcetype=yoursourcetype  AuthReject
| stats count by CN
| where CN > 2

If you save this search as an alert, you can set the trigger condition to "number of results greater than zero".
You will need to identify the time range though: "number of failed login attempts in the last hour" is a very different thing than "number of failed login attempts in the past week."

[lguinn2]

Instead of hoping that someone in the community knows Siteminder, you could post a small portion of the log (with things like user names obfuscated). This would let many members answer your question...

[lguinn2]

Also it would be helpful to know what you used as a sourcetype, and the necessary field names.