Alerting

Why am I not receiving my real time alerts to list attempts of brute force attacks?

monteirolopes
Communicator

Hi,

I created an alert to list attempts of brute force attacks.

Something like:

"source="WinEventLog:Security"  EventCode = 4771 |  transaction user, ip  maxpause=10s |  table user, ip, eventcount | WHERE eventcount > 10"

I am running the search in real-time and I can see the results but my alert is not working! The alert is configured in real-time and the trigger's condition is configured per-result, but I still don't receive any e-mail alert.

Best Regards,
Lopes.

0 Karma

inventsekar
Ultra Champion

I am running the search in real-time and I can see the results but my alert is not working ///
-are you seeing more than 10 events or less? also,
-can you double check the email notification settings?
---- the alert email is it set for number of results or hosts or ...

0 Karma

monteirolopes
Communicator

Hi inventsekar, thanks for your reply.

  • Yes, I am seeing users that contains more than 10 events. Follow an example of my real-time results:

User IP
John.carl 10.10.10.10
richard-grey 8.8.8.8
PAUL 10.11.11.11

My alert is configured to send mail by result, in this case, for example, I have 3 results, but I am receiving just 1 mail with 1 result, for example, PAUL 10.11.11.11.
What about the other users?

Best regards,
Lopes.

0 Karma

nzou_splunk
Splunk Employee
Splunk Employee

Hi Lopes,
Not sure if you set your mail server settings correctly?
Settings -> server settings -> Email settings

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...