Investigate FailedLoginsPerIP

When a ClientIP has met or exceeded the FailedLoginsPerIP threshold, a great first step is to extract all requests from that IP address having occurred between the Start and End~ timestamps.

Alert Raised

Suppose this alert was identified by WebsiteFailedLogins.

ClientIP = 10.1.1.10
FailedLogins = 100
Sitename = W3SVC2
IISLogPath = D:\inetpub\logs\LogFiles\W3SVC2
Authentication = Windows
HttpResponse = 401
Start = 2019-01-01T18:30:00Z
End~ = 2019-01-01T19:00:10Z

Identify Requests

1. Update the following Logparser query with settings from the alert. Save it as ClientIPRequests.sql.

-- Start ClientIPRequests.sql --
SELECT *
INTO ResultsFile.csv
FROM 'D:\inetpub\logs\LogFiles\W3SVC2\*'
WHERE s-sitename LIKE 'W3SVC2'
	AND c-ip LIKE '10.1.1.10'
	AND TO_TIMESTAMP(date,time)
		BETWEEN TIMESTAMP('2019-01-01 18:30:00', 'yyyy-MM-dd HH:mm:ss')
		AND TIMESTAMP('2019-01-01 19:00:10', 'yyyy-MM-dd HH:mm:ss')
-- End ClientIPRequests.sql --

2. Run the query using the following command.

logparser.exe -recurse:-1 -i:IISW3C -o:CSV file:ClientIPRequests.sql

3. Review the results in ResultsFile.csv. See Additional Information section for things to look for.

NOTE: IIS logs date/time in UTC.