investigate_failed_logins_for_multiple_destinations.yml

name: Investigate Failed Logins for Multiple Destinations
id: 097e8030-8662-4254-a735-bf0bdda696e3
version: 1
date: '2019-12-10'
author: Patrick Bareiss, Splunk
type: Investigation
datamodel:
- Authentication
description: This search returns failed logins to multiple destinations by user.
search: '| tstats count `security_content_summariesonly` earliest(_time) as first_login
  latest(_time) as last_login dc(Authentication.dest) AS distinct_count_dest values(Authentication.dest)
  AS Authentication.dest values(Authentication.app) AS Authentication.app  from datamodel=Authentication
  where Authentication.action=failure by Authentication.user | where distinct_count_dest
  > 1 | `security_content_ctime(first_login)` | `security_content_ctime(last_login)`
  | `drop_dm_object_name("Authentication")` | search user=$user$'
how_to_implement: To successfully implement this search you need to be ingesting authentication
  logs from your various systems and populating the Authentication data model.
known_false_positives: ''
references: []
tags:
  analytic_story:
  - Credential Dumping
  product:
  - Splunk Phantom
  required_fields:
  - _time
  - Authentication.dest
  - Authentication.app
  - Authentication.action
  - Authentication.user
  security_domain: endpoint