medium10 pts · first answer countssplunksiem-queries

Splunk query for failed logons

Which Splunk SPL search lists the source IPs with the most failed Windows logons?

A.index=wineventlog EventCode=4624 | stats count by Account_NameB.index=wineventlog EventCode=4625 | stats count by Source_Network_Address | sort - countC.index=wineventlog | where count > 10 | table EventCodeD.index=wineventlog EventCode=4625 | dedup Source_Network_Address | head 1

Discussion 0

Join free to post in the discussion.

Related questions