name: High Number of Login Failures from a single source
id: 7f398cfb-918d-41f4-8db8-2e2474e02222
version: 1
date: '2020-12-16'
author: Bhavin Patel, Splunk
type: batch
datamodel: []
description: This search will detect more than 5 login failures in Office365 Azure
  Active Directory from a single source IP address. Please adjust the threshold value
  of 5 as suited for your environment.
search: '`o365_management_activity` Operation=UserLoginFailed  record_type=AzureActiveDirectoryStsLogon
  app=AzureActiveDirectory | stats count dc(user) as accounts_locked values(user)
  as user values(LogonError) as LogonError values(authentication_method) as authentication_method
  values(signature) as signature values(UserAgent) as UserAgent by src_ip record_type
  Operation app | search accounts_locked >= 5| `high_number_of_login_failures_from_a_single_source_filter`'
how_to_implement: ''
known_false_positives: unknown
references: []
tags:
  analytic_story:
  - Office 365 Detections
  asset_type: Office 365
  cis20:
  - CIS 16
  kill_chain_phases:
  - Actions on Objectives
  mitre_attack_id:
  - T1110.001
  nist:
  - DE.DP
  - DE.AE
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - Operation
  - record_type
  - app
  - user
  - LogonError
  - authentication_method
  - signature
  - UserAgent
  - src_ip
  - record_type
  security_domain: threat
