SOC Analyst interview question

How would you write a Splunk search to detect multiple failed logins followed by a success?

What interviewers are really testing

• Fluency with stats/transaction
• Understanding the brute-force pattern
• Tuning awareness (thresholds, time windows)

A strong answer framework

1. Search EventID=4625, stats count by Account_Name, Source_IP
2. Filter count above threshold inside a 5-minute window
3. Correlate a 4624 success for the same account in the window
4. Prefer stats + self-join over transaction at scale
5. Alert on the pattern; tune threshold to cut noise

Follow-ups you should be ready for

• transaction vs stats - when to use each?
• How do you reduce false positives?
• Which field shows the logon type?

More real SOC Analyst interview questions

• A domain controller is making outbound connections to an external IP on port 443. No maintenance is scheduled. How do you investigate?
• A user reports clicking a link in a phishing email. Walk me through your response.
• How do you decide whether an alert is a true positive or a false positive?