Currently, in our SIEM environment, we are attempting to reduce noise and any non-actionable items. One of the most frequent items we receive on a weekly basis is a report based on excessive member and server authentication failures.
The overall concept is to inform us of any accounts that consistently fail authentication on a host over a 24hr period, where no successful events are seen within the same 24hr period. We often determine the type of failure based on the event code that it is producing as well as the signature/signature ID.
Our standard process is to contact the account or server owner and have he/she investigate what is causing the excessive failures. This process can be rather lengthy and time-consuming and is dependent on analyst communication to the account owner. I'd say 95% of these alerts are not actionable or they are closed after a follow-up SIEM search.
To avoid a possible brute force attack we do monitor these logs. My question is; is there an additional layer of filtering or rules that be tweaked to reduce these logs.
Common Event Codes:
Also is there perhaps a different process that can be utilized for monitoring and reporting such excessive accounts. At, the moment we need to create a new tracking ticket for each and every account that meets our current standard and/or threshold.
Through analysis, I would believe that if an analyst can determine if the failure is indeed a brute-force is actionable than we would then complete the required steps. Otherwise, these excessive failures can be reviewed and forwarded to the respected account owner as needed.
Any thoughts on the matter? Thank you!