Forum Discussion

Eric_Egolf's avatar
Eric_Egolf
5 years ago
Solved

Monitoring Logoff/Logon Events for Anomalies

Background - We have a fairly large citrix environment(70 customers, 1200 users). Each customer has 1 or more xenapp servers depending on how many users. The environment is setup in a manner that o...
  • Cole_McDonald's avatar
    Cole_McDonald
    5 years ago

    Sure... I'm using this as a datasource targeting isWindows() called "Active Directory Failed Login Count" 

    try {
    $events = Get-WinEvent                  `
        -ComputerName    ##system.sysname## `
        -ErrorAction     SilentlyContinue   `
        -FilterHashtable @{
            LogName   = "Security"
            Id        = 4625
            StartTime = (get-date).AddMinutes(-5)
        }                                  `
        | where Message -Match "0xC000006D"
} catch {
        $events = @()
}

"$($events.count)"

    No warranty for the code, use at your own risk.  Please note the use of backtick line continuation for readbility.

Cole_McDonald's avatar
Cole_McDonald
Icon for Professor rankProfessor
5 years ago

I'm doing something like this for failed logon attempts with a simple threshold (event ID 4625 in windows).  For that, I'm gathering 5 minutes of security log and counting the # of bad password 4625 events.

For your purposes, if you were to have a DS that ran every 5 minutes, it could gather 1 hour of log data, then count an event (whatever the first one for a successful logon is in your environment), then count those in the last 5 minutes and create a ratio.  You can then threshold that ratio for alerting.  It's basically just getting the current percentage of that event now vs. the past hour... you could even multiply by 100 to make it an actual percentage.

If you wanted to get really fancy, you could check every 5 minute segment over that hour except the last one, average them, then compare the last segment to that average... even more fancy, given that data set, you'll have enough to generate a standard deviation, which you can then use as a threshold for the alert.

I'm using powershell for my scripts as I know it better than groovy... and it has quite a bit more windows specific commands for gathering data.  This would allow you to use $events = get-winevent to gather logs from windows then filter for the event ID and for some various content to eliminate even more of the unnecessary events before wrapping it in ($events).count