Splunk Authentication Investigation Workflow

Skills you can inspect

Splunk search & export

Retrieved individual authentication events through the running lab's authenticated CLI. Kept event fields and source identifiers, not just alert totals.

Python & validation

Added _time to the existing timestamp aliases and reused the importer, investigation logic and HTML report generator. Inspect the CSV contract checks.

Time & data integrity

Preserved the raw export, mapped its observed Pacific time labels to explicit offsets, and normalized to UTC. Kept input hashes and source-record references attached to the case.

Analyst communication

Turned five preceding failures followed by success into a reviewable lead. The excerpt below exposes the sequence, its evidence and the questions an analyst still needs to answer.

Inspect one candidate

Account A · Host A · Source A. Five failures are followed by success five minutes after the first failure. All six records share the same original account, host and source IP; those values are replaced here with display aliases.

Why it matched: AUTH_FAILURES_THEN_SUCCESS looks for at least five preceding failures within an inclusive 600-second window for the same user, host and IP. This sequence is a candidate, not proof of compromise.

Analyst follow-up: check account ownership, MFA results, session details, device context and approved activity. Mistyped passwords, stale credentials or an authorized test can explain the same pattern. These are proposed checks, not completed investigative actions.

This is a sanitized excerpt, not the full report or a screenshot. Six supporting events are shown; five other candidates and 64 other events are omitted. UTC timestamps and source-record references are unchanged. Raw rows, private file paths and original identity values are not published.

Engineering decisions that matter

1. Keep time interpretation explicit.

   The preparation step mapped the export's two observed Pacific time labels to -07:00 and -08:00. The raw export stayed intact. This is a bounded transformation, not a general timezone detector.

2. Preserve identity and sequence boundaries.

   Authentication joins stay within user, host and IP. A success resets preceding failure history; an equal-time failure cannot establish an order before success.

3. Make incomplete evidence visible.

   The importer preserves rejected records and reports partial processing when appropriate. This 70-event run had no rejections and no rows coalesced as duplicates. Those counts do not establish upstream uniqueness or detection accuracy.

4. Keep output safe to inspect.

   Log text is escaped in HTML; commands and URLs from input are inert. The tool does not execute response actions or overwrite an existing output directory.

Code and reproducible examples

The executed implementation produced both case.json and report.html. Its COMPLETE result means all 70 input rows met the supported schema—not that the activity was harmless, malicious or fully investigated.

The public excerpt records the retained case's SHA-256 and implementation reference. These bind the excerpt to the saved work; they are provenance records, not independent attestation. The full export and original case remain private.

Separate 20-row fixture walkthrough

The earlier committed fixture exercises malformed data, duplicates and benign controls: 20 input rows, 13 accepted events, one duplicate, six rejected rows and three review candidates. Its recorded result is PARTIAL because rejected rows remain visible. This is a separate run, not the 70-event Splunk report above. Use the reproduction guide to run the bundled fixtures with Python 3.11+.