Hello,
I have created a search for failed logins for win,linux and network devices from authentication datamodel but this is generating lot of false positive alerts. Please help me to finetune this search
| from datamodel:"Authentication"."Failed_Authentication" | search NOT user IN ("sam","sunil")
| stats values(signature) as signature, dc(user) as "user_count", dc(dest) as "dest_count" latest(_raw) as orig_raw, count by "app","src",user
| where 'count'>=200 AND user_count=1 | head 5
