LAB-02SIEM
First Splunk investigation: failed-logon spike
Objective
Turn a burst of Windows 4625 events into a decision: brute force or misconfigured service account.
What I did
Forwarded event logs, built a search grouping failures by source host and account, then pivoted on the first success after the spike.
Results
Saved the search as an alert with a threshold tuned to the baseline.
What I learned
The pivot to the successful logon is what makes the alert actionable.
Tools
SplunkWindows Event LogsSPL