Finding maximum login attempts in the span of 10 min

[sujald]

Hey can anybody help with this task of how to find an account with the most login attempts  in the 4624 events within a time span of 10 min

[bowesmana]

As @PickleRick says, streamstats with the rolling 10m time window

... EventID=4624
...
| streamstats time_window=10m count by user
| stats max(count) as max by user
| sort - max
| head 1

or if you also want to show the time of the 10 minute window

...
| streamstats time_window=10m count by user
| eventstats max(count) as max by user
| where count=max
| stats max(count) as max by _time user 
| sort - max

[ITWhisperer]

It is a bit difficult to suggest a solution without know what your events looks like. Please share some anonymised representative events.

Alternatively, if the account name in your events is "user", you could try something like this

| bin _time span=10m
| stats count by _time user

[PickleRick]

@ITWhispererI assume that 4624 means windows eventcode so they are standard windows event logs. 🙂

@sujaldThe easiest approach is indeed the one shown by @ITWhisperer but it will show you number of logins aligned to 10-minute periods. So if someone logged in every minute from 10:13 till 10:26, you will get two separate "buckets" of logins - one starting at 10:10, another at 10:20. If you want a moving window count, you'll need to employ the streamstats command with time_window=10m.