Splunk searches to find password spraying in Auth DM

gistfile1.txt

# Needs time and host components

| tstats summariesonly=true allow_old_summaries=true count FROM datamodel=Authentication by _time Authentication.src_user Authentication.user | rename Authentication.* as * | stats dc(user) as user_count values(user) as users by src_user

# Base tstats search to get the initial data
| tstats summariesonly=true allow_old_summaries=true count FROM datamodel=Authentication by _time Authentication.action Authentication.src Authentication.dest Authentication.src_user Authentication.user Authentication.signature Authentication.signature_id