How to get the results of a correlation search when we have success after login failures by user?

[abhi04]

Hi All,

Below is the correlation search. I want the results for bruteforcesearch query only when we have successful login after failure attempts by user. The alert should trigger only if we have successful login after failure attempts and not when we only have failure attempts. Please help on the below.

| from datamodel:"Authentication"."Authentication" | stats values(tag) as tag,count(eval('action'=="failure")) as failure,count(eval('action'=="success")) as success by user app | search failure>10 success>0 | xswhere failure from failures_by_src_count_1h in authentication is above medium

[abhi04]

The below query does not work, though the time_success and time_failure is showing correctly but after using the where command it does not show any results even though it holds true.

| tstats values(Authentication.src) values(Authentication.dest) count
from datamodel=Authentication.Authentication
where Authentication.action=failure (Authentication.user!="ANONYMOUS LOGON")
by _time, Authentication.user, Authentication.action
| search Authentication.user=Roshni.Hazra
| eval Time_failure=strftime(_time,"%m/%D/%Y %m:%h:%s")
| union
[ tstats values(Authentication.src) values(Authentication.dest) count
from datamodel=Authentication.Authentication
where Authentication.action=success
by _time, Authentication.user, Authentication.action
| search Authentication.user=Roshni.Hazra
| eval Time_success=strftime(_time,"%m/%D/%Y %m:%h:%s")]
| where Time_success>=Time_failure