Could you help me build when a user manages to block his password 3 times in a 24 hour period generate a trigger?

[Freeza]

hi team,

could you help me build when a user manages to block his password 3 times in a 24 hour period generate a trigger? this for each user.. I'm thinking of something like this.

index="main" source="wineventlog:security" EventCode=4740 earliest=-25h 
| rex field=_raw "(?<Account>Account That Was Locked Out:)" 
| search NOT Account_Name="Guest" 
| eval Period=if(_time>relative_time(now(),"-1h"),"New","Old" ) 
| stats count values(Period) as Period by acct_name 
| where mvcount(Period)=1 AND Period="New" AND count >= 3
| sort -count 
| head 10 
| fields -Period

but apparently it doesn't work.

[richgalloway · Accepted solution]

Apparently?  Either it works or it does not.  If it doesn't then please say how it fails you.

I can see a few reasons why this search may not work as expected.

1) The rex command sets the Account field to the fixed string "Account That Was Locked Out:" rathe than to an account name.  If you want to extract the account name here, try

| rex field=_raw "Account That Was Locked Out:\s*(?<Account>\w+)" 

2) The query appears to use Account, Account_Name, and acct_name interchangeably.  The account name likely is in only one of those.  If not, additional commands should be used to combine them into one field.

3) where Period="New" won't work with a multivalue field.  Try where mvfind(Period, "New").

4) If the goal is to find 3 failures in the last 24 hours then use earliest=-24h.