Overview

In this lab, I used Wazuh Threat Hunting to investigate repeated authentication failures and determine whether the activity was benign or suspicious. The focus was on correlation and context, not just alert volume.

​

What I Did

I reviewed authentication failure events, validated escalation behavior, and identified when the pattern moved from low concern to true suspicious activity based on frequency and timing. I then searched for authentication success events and correlated them to determine whether a successful login occurred after the failed attempts.

​

Findings

At first, the activity could be explained by user error because the source IP was internal and attempts were limited. After generating more failures in a short time window, Wazuh escalated severity and the activity became a true positive requiring investigation. I also identified successful authentication events shortly after the failures, which increased risk and justified further monitoring.