Splunk basic search

index=windows EventCode=4625 | stats count by src_ip

Base Splunk search that groups failed logons by source IP to spot brute force and sprays at a glance.

Run it when you want the picture of failed logons across the fleet: the SPL filters for 4625 and groups by src_ip, giving a ranking of sources — an IP with hundreds of failures is brute force; multiple accounts failing from the same IP is a spray. It's the first search a level 1 analyst learns and the foundation of most authentication rules. In Splunk, the stats count by pattern is the daily bread: the same structure works for grouping by user, host, or any field.

Don't use it without a time window in large environments: the count without earliest/latest mixes months of noise and the ranking means nothing — narrow it with earliest=-1h or -24h. Grouping by src_ip assumes the field is parsed: without the Windows add-on properly configured, src_ip may come empty and the result groups under a null value. And watch out: legitimate failures (expired service credentials) dirty the ranking — filter by LogonType or by accounts before alerting. For continuous detection, this search becomes an alert with threshold and window.