Below is the correlation search. I want the results for bruteforcesearch query only when we have successful login after failure attempts by user. The alert should trigger only if we have successful login after failure attempts and not when we only have failure attempts. Please help on the below.
| from datamodel:"Authentication"."Authentication" | stats values(tag) as tag,count(eval('action'=="failure")) as failure,count(eval('action'=="success")) as success by user app | search failure>10 success>0 | xswhere failure from failuresbysrccount1h in authentication is above medium