Splunk ES Notable Event

| tstats count from datamodel=Authentication by _time, Authentication.user, Authentication.src | where count > 5

Splunk Enterprise Security correlation search that generates a Notable Event when an account accumulates multiple failed logons in a short window.

Deploy this correlation search in Splunk ES when you want to turn failed logons into an actionable Notable Event: the search uses the Authentication datamodel (which normalizes Windows 4625, VPN, Okta, etc.) and groups by user and source. The result feeds ES's detection framework: it generates the Notable, applies risk rules (risk scoring), and can trigger the response playbook (block the source, ticket the team). It's the way to have spray detection with the full cycle — detection, prioritization, and response — instead of a loose query.

Don't use it without the Authentication datamodel properly populated: if your logon sources aren't mapped to Splunk's CIM (Common Information Model), the search over the datamodel returns empty — verify with a test search over the datamodel first. The threshold (count > 5) needs calibration: in environments with legitimate failures (VPN, expired credentials), a low threshold generates noise that ends up silencing the Notable. And watch out: the datamodel sees volume, not the password used — to confirm the spray, cross-reference with the password field if your source logs it, or with the single-source pattern.