Detect brute force attacks using Splunk

Views: 50

To detect brute force attacks using Splunk, you can create queries that monitor and analyze relevant log data. Here are some example Splunk queries that can help you identify potential brute force attack patterns:

1. Detecting failed login attempts from a single source:

index=<your_index> source=<your_log_source> "Failed password" | stats count by src_ip
| where count > <threshold>

Explanation: This query searches for log entries containing the phrase “Failed password” and then groups them by the source IP address. Adjust the <your_index>, <your_log_source>, and <threshold> values according to your environment.

2. Detecting multiple failed login attempts within a time window:

index=<your_index> source=<your_log_source> "Failed password" | bucket _time span=<time_window>
| stats count by src_ip _time
| where count > <threshold> by src_ip

Explanation: This query aggregates failed login attempts within a specified time window (e.g., 5 minutes). Adjust the <your_index>, <your_log_source>, <time_window>, and <threshold> values as per your requirements.

3. Identifying brute force attempts against multiple user accounts:

index=<your_index> source=<your_log_source> "Failed password" | stats count by src_ip user
| where count > <threshold> by user, src_ip

Explanation: This query groups failed login attempts by both source IP address and user account, allowing you to detect brute force attacks targeting multiple accounts. Modify the <your_index>, <your_log_source>, and <threshold> values accordingly.

4. Monitoring excessive authentication failures across multiple log sources:

(index=<your_index1> source=<your_log_source1> "Failed password") OR
(index=<your_index2> source=<your_log_source2> "Failed password") OR ...
| stats count by src_ip
| where count > <threshold>

Explanation: This query combines log entries from multiple log sources and indexes, searching for occurrences of “Failed password.” Adjust the <your_index1>, <your_log_source1>, <your_index2>, <your_log_source2>, and <threshold> values to match your environment