splunk - 使用 splunk 发现蛮力攻击

Question

我有几次登录失败，然后管理员成功了，这就是我所拥有的，但似乎没有得到任何结果：

source=WinEventLog:Security EventCode=4625 OR EventCode=4624 
 | bin _time span=5m as minute 
 | eval username=mvindex(Account_Name, 1)
 | stats count(Keywords) as Attempts,
 count(eval(match(Keywords,"Audit Failure"))) as Failed,
 count(eval(match(Keywords,"Audit Success"))) as Success by minute username
 | where Failed>=2
 | stats dc(username) as Total by minute 
 | where Total>3

关于找到用户失败的登录尝试然后成功登录的更好方法的任何想法？

Answer 1

Splunk Security Essentials 应用程序有一个示例蛮力尝试检测查询。