Failed login alert issue

[raghav013]

We have a alert created in my orgainzation for failed login alerts, It is working fine but for last ttwo days we are getting excessive failed login alerts for a particular account on email as we have set to send the alert if the failed account is more that 10, it is working fine for other account and i am also able to see the failed login logs for all other accounts except this one which has more than 15000 failed login alerts.

[DalJeanis]

Okay, first, your organization needs to figure out what automated system is hitting that account and get that turned off.

Second, if you need a method to suppress alerts for this one account, you are going to have to modify the search/alert.

I would suggest you create a lookup table, here called "SuppressAlerts.csv", with a field (here called USER) containing the userID in question. We're going to assume the username field in the event is UserName.

At the end of your search, do this

| lookup SuppressAlerts.csv USER as UserName OUTPUT USER as SuppressMe
| where isnull(SuppressMe)

That will kill the one alert in question. You will need to set up some organizational method of reviewing the SuppressAlerts.csv lookup periodically to see if the suppression is still valid.

[thambisetty]

Whats your question here?
You have created an alert and its mached and creating alerts.

[YoungDaniel]

alertception