Try in Splunk Security Cloud


This search detects when an excessive number of authentication failures occur this search also includes attempts against MFA prompt codes

  • Type: Anomaly
  • Product: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • Last Updated: 2020-12-16
  • Author: Rod Soto, Splunk
  • ID: d441364c-349c-453b-b55f-12eccab67cf9


ID Technique Tactic
T1110 Brute Force Credential Access
`o365_management_activity` Workload=AzureActiveDirectory UserAuthenticationMethod=* status=Failed 
| stats count earliest(_time) as firstTime latest(_time) values(UserAuthenticationMethod) AS UserAuthenticationMethod values(UserAgent) AS UserAgent values(status) AS status values(src_ip) AS src_ip by user 
| where count > 10 
| `o365_excessive_authentication_failures_alert_filter`

Associated Analytic Story

How To Implement

You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity

Required field

  • _time
  • Workload
  • UserAuthenticationMethod
  • status
  • UserAgent
  • src_ip
  • user

Kill Chain Phase

  • Not Applicable

Known False Positives

The threshold for alert is above 10 attempts and this should reduce the number of false positives.


Risk Score Impact Confidence Message
64.0 80 80 User $user$ has caused excessive number of authentication failures from $src_ip$ using UserAgent $UserAgent$.


Test Dataset

Replay any dataset to Splunk Enterprise by using our tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

source | version: 1