Security

How can I configure a password authentication failure alert?

alialbarwani
New Member

Hi there, I would like to configure Splunk to send an alert when password entry is incorrect 3 times. How can this be done?
Thanks in advance.

0 Karma

brian_rampley
Path Finder

I'm assuming you are wanting alerts when someone enters the wrong password trying to log into Splunk.

You can create the alert using SPL to search the internal Splunk logs. Here's a basic search, which can be added on as needed:

index=_internal component=UiAuth action=login status=failure

If you are wanting an alert for a failed logins on a system other than Splunk, then obviously you will need to collect those logs in Splunk and create a search for them.

Once you have your search, you can follow the directions in the splunk docs for creating an alert:
https://docs.splunk.com/Documentation/Splunk/latest/Alert/Aboutalerts

0 Karma

adonio
Ultra Champion

create a search that capture your condition,
click save as on the top right corner -> pick "alert" -> use the prompts to set up your alert
read here all the way for detailed information
https://docs.splunk.com/Documentation/Splunk/latest/Alert/Aboutalerts
hope it helps

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...