Dynamically generate user login failures

oanyanetu — Mon, 19 Oct 2020 09:45:07 GMT

Hello.

I am trying to compute a user's login failure rate so I can pit that against their daily failure rate to see if they're staying within their expected behavior.

The problem is that a user may not login everyday so something like

... | eval av=(FailedLogin/7)

won't work if a user does not login everyday.

Is there a way to say

where I am saying iterate over a set of days and determine if a user had a failed login. If so increment the counter, do it in 1 day buckets (is there a better way?) then finally take my counter, find my true average for failed logins and if they are above their average print out their username, ip, and other stats.

Re: Dynamically generate user login failures

t_shreya — Mon, 19 Oct 2020 11:05:25 GMT

Hi,
I think the following query may help.

where,

bin span=1d _time

would help divide the data into 1 day buckets,

eventstats count as FailedLoginForThisDay by user,_time

would calculate the number of failed logins per day and user

eventstats avg(FailedLoginForThisDay) as avg_failed_logins by user

would calculate the average failed logins per user

Thanks.

topic Re: Dynamically generate user login failures in Reporting

Dynamically generate user login failures

Re: Dynamically generate user login failures