LAB-02SIEM

First Splunk investigation: failed-logon spike

Objective

Turn a burst of Windows 4625 events into a decision: brute force or misconfigured service account.

What I did

Forwarded event logs, built a search grouping failures by source host and account, then pivoted on the first success after the spike.

Results

Saved the search as an alert with a threshold tuned to the baseline.

What I learned

The pivot to the successful logon is what makes the alert actionable.

Tools

SplunkWindows Event LogsSPL