SPLUNK ALERT:

LOGON FAILURES

BY,
JAMNAS SADIQ
REDTEAM

1
CONTENTS

 What is a Splunk?

 Open Splunk enterprise.

 Creating an alert when a logon request fails.

 Checking the alert and events.

2
 What is a Splunk?

Splunk is a powerful software platform designed to help organizations

make sense of their machine-generated data. It allows users to collect,
index, and analyze large volumes of data in real-time from diverse
sources such as log files, applications, sensors, and more. With its search
and analytics engine, powered by the Splunk Search Processing Language
(SPL), users can perform complex searches, create visualizations, and
generate reports to gain valuable insights from their data. Splunk offers
features for log management, security monitoring, troubleshooting, and
business intelligence, making it a versatile tool for a wide range of use
cases. By enabling users to harness the potential of their data, Splunk
empowers organizations to improve their operations, enhance security,
and drive informed decision-making.

3
 OPEN SPLUNK ENTERPRISE

 Select search and reporting option

4
 And select data summary option to select our host:


Select the host:



Eiizy is the local pc

Creating an alert when a logon request fails

5
 After entering the local pc select save as option

Then click second option alert to create an alert,

6
 In this, give title as logon failure
Select permission as private,
Alert type as real time 24hrs,

 In trigger condition, trigger alert when: select ‘number of

results’
Type greater than “2 “
In “1”
7
Trigger as for each result

 In trigger action
Select add to triggered alerts
And select the severity as medium

And save it. Close the confirmation message,

Checking the alert and events

Now to check the alert and events:

8
Lock the pc and type some incorrect passwords to trigger
the alert.

(it’s a picture took from an external device)

Now again open Splunk enterprise and go to alert option

9
 In alert option the alert title that we created and saved
Wil be visible as logon failure

By clicking that ` trigger history will be there

10
also, in the triggered alerts option

Failed login can be seen and its severity

11
Events, the failed logins also seen in the events list:

By mentioning the event code 4625 in search bar and changing

its TIME into all-time it'll be easy to catch failed events...

So, this is how an alert trigger when a login attempt fails.

12
Thank you...

13