SIEM - Search for Failed logins

This playbook searches for failed logon on a specific user by querying logs from different sources. Supported Integrations: -Splunk -QRadar -Azure Log Analytics.

Common Playbooks · 16 tasks · 6 inputs · 4 outputs

Inputs

  • SplunkIndex — Splunk's index name in which to search. Default is "*" - All.
  • SplunkEarliestTime — The earliest time for the Splunk search query.
  • SplunkLatestTime — The latest time for the Splunk search query.
  • QRadarSearchTime — The Search Time for the QRadar search query. for example: Last 1 days
  • AzureSearchTime — The Search Time for the Azure Log Analytics search query. for example: ago(1d)
  • Username — User name.

Outputs

  • NumOfSiemFailedLogon — Number of failed login from Siem.
  • QRadar.SearchEvents — The result of the QRadar search.
  • Splunk.Result — The results of the Splunk search. The results are a JSON array, in which each item is a Splunk event.
  • AzureFailedLogonLogs — The result of the Azure Log Analytics search.

Commands used

azure-log-analytics-execute-query qradar-search-retrieve-events splunk-search

Flowchart

Azure Log Analytics QRadar Splunk yes yes yes Start Start Splunk Splunk QRadar QRadar Is SIEM enabled and the user name is defined? Is SIEM enabled and the u... Search for failed logon attempts using Splunk - splunk-search Search for failed logon a... splunk-search Azure Log Analytics Azure Log Analytics Search for failed logon attempts using Azure Log Analytics - azure-log-analytics-execute-query Search for failed logon a... azure-log-analytics-execute-q... Count failed logon from Azure Log Analytics logs - CountArraySize Count failed logon from A... CountArraySize Count failed logon from QRadar logs - CountArraySize Count failed logon from Q... CountArraySize Count failed logon from Splunk logs - CountArraySize Count failed logon from S... CountArraySize Found results from QRadar? Found results from QRadar? Found results from Splunk? Found results from Splunk? Found results from Azure Log Analytics? Found results from Azure ... Done Done Set Number Of SIEM Failed Logon to Zero - Set Set Number Of SIEM Failed... Set Run Qradar Search - qradar-search-retrieve-events Run Qradar Search qradar-search-retrieve-events