Salam guys
I wrote the Correlation Search Query and added the Adaptive Response Actions (notable, risk analysis and send to soar), but when the event goes to soar there's no event_id in the artifacts
SPL Query:
[
| tstats summariesonly=true values("Authentication.user") as "user",values("Authentication.dest") as "dest",count("Authentication.dest") as "dest_count",count("Authentication.user") as "user_count",count from datamodel="Authentication"."Authentication" where nodename="Authentication.Failed_Authentication" by "Authentication.src","Authentication.app" | rename "Authentication.src" as "src","Authentication.app" as "app" | where 'count'>5
]
