An end-to-end lab covering brute-force credential detection: SPL alert logic, a structured triage method, and a response workflow designed to be run again by someone who was not there the first time.
Failed logons are constant in any Windows estate. Most are a mistyped credential; a few are not. The goal of this lab was to find the difference reliably — identify anomalous authentication patterns, cut alert fatigue through threshold tuning, and turn raw event data into a structured, repeatable response workflow.
It is deliberately unglamorous work. The value is in the write-up: anyone picking this up later should be able to rebuild the query, understand why the threshold sits where it does, and follow the same triage path.
Nothing skipped and nothing assumed. Each step produced an artefact the next step depended on.
Windows Security Event Logs — specifically Event ID 4625, failed logon — ingested into Splunk Enterprise and normalised so that source host, account name, and timestamp could be queried consistently rather than parsed by hand each time.
SPL queries written to correlate failed logon volume across source IP, user account, and time window — the combination that separates one frustrated user from a single host hammering many accounts.
Correlated events reviewed, thresholds adjusted to cut false positives without losing the signal, and the analyst decision points written down — including what was ruled out and why.
Analyst actions, escalation criteria, and reusable case notes defined so the next occurrence follows a known path instead of restarting the investigation from scratch.
A small toolset used properly, and the competencies the lab was built to exercise.
The result is a self-contained use case demonstrating credential-attack detection, a structured triage method, and a documented analyst workflow that would transfer to a real operations environment without rewriting.
The write-up and queries live in the repository. The two staged labs that follow this one are indexed in the case files.
If the next person cannot repeat it from the notes, the lab is not finished.