Security

Unexpected Results

sbgoldberg13
Explorer

I'm testing a modified Security Essentials Basic Brute Force Detection search. When I run the search portion, I get plenty of results with Audit Success. But when I include the stats portion, only Failures are returned. Am I missing something here?

index=wineventlog source=WinEventLog:Security OR tag=authentication Account_Name=* Account_Name!=""
| stats count(eval (Keywords="Audit Success")) as Successes count(eval(Keywords="Audit Failure")) as Failures by Source_Network_Address | where Successes>0 OR Failures>0

Thanks.

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

The "Keyworks" field is not the correct field to use (this field is pretty much useless and just indicates that logging was successful). You should instead have an "action" field that indicates if the login was successful or not.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...