cancel
Showing results for 
Search instead for 
Did you mean: 
Highlighted

Simply Correlation Rule - 5 failed logon attempts for that same user

Hi guys,

Simply (not in McAfee) CRL.

I need to alarm if 5 failed logon attempts have place in 5 minutes time period for that same user.

I did correlation

Filters - and Normalization Rule in  [Login]

Event subtype in [failure]

How to set this condition that it have to be done 5 times in 5 mintes for that same user name?

PLS HELP ME

3 Replies

Re: Simply Correlation Rule - 5 failed logon attempts for that same user

Use the "AND" gate around your filter. Edit the AND gate to set the threshold on 5 en time on 5 minutes.

In the correlation rule, under "Group by" select "Source User"

This should do the trick.

Re: Simply Correlation Rule - 5 failed logon attempts for that same user

Perfect we are really close   Problem is that it is triggering 8 events for different source user
Any idea what can be the problem? I  am guessing that probably aggregation for such message must be disabled by why it cannot count to 5?

Re: Simply Correlation Rule - 5 failed logon attempts for that same user

Aggregation should not be the issue as aggregation numbers are added up to the total event count threshold.

Make sure that you group by "Source User" in the correlation rule. If you don't do this, the correlation engine will not group each unique source user and correlation will trigger when 5 or more logins happen (regardless of number of unique source users). By grouping on source user, a correlation event will only trigger if a specific source user fails to login 5 or more times within the timewindow specified.

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator
  • Community Help Hub

      New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

    • Find Forum FAQs
    • Learn How to Earn Badges
    • Ask for Help
    Go to Community Help

    Join the Community

      Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

    • Get helpful solutions from McAfee experts.
    • Stay connected to product conversations that matter to you.
    • Participate in product groups led by McAfee employees.
    Join the Community
    Join the Community