SIEM - Search for Failed logins

This playbook searches for failed logon on a specific user by querying logs from different sources. Supported Integrations: -Splunk -QRadar -Azure Log Analytics.

Pack

CommonPlaybooks

Tasks

16

Inputs

• SplunkIndex — Splunk's index name in which to search. Default is "*" - All.
• SplunkEarliestTime — The earliest time for the Splunk search query.
• SplunkLatestTime — The latest time for the Splunk search query.
• QRadarSearchTime — The Search Time for the QRadar search query. for example: Last 1 days
• AzureSearchTime — The Search Time for the Azure Log Analytics search query. for example: ago(1d)
• Username — User name.

Outputs

• NumOfSiemFailedLogon — Number of failed login from Siem.
• QRadar.SearchEvents — The result of the QRadar search.
• Splunk.Result — The results of the Splunk search. The results are a JSON array, in which each item is a Splunk event.
• AzureFailedLogonLogs — The result of the Azure Log Analytics search.

Commands used

• azure-log-analytics-execute-query
• qradar-search-retrieve-events
• splunk-search