Help with rule taking to long to run

[Nath1]

Hello, I have been asked to optimize this logic because is taking too long to run. I am not sure how else can I write to make it run faster. It's not throwing any errors it just takes a long time to run. Any help would be highly appreciate. 🙂 Thanks!

index IN (indexes) sourcetype=xmlwineventlog sAMAccountName IN (_x*, x_*, lx*, hh*)

| lookup mas_pam_eventcode.csv event_code AS EventCode OUTPUT action

| stats count(eval(action=="login_failure")) as failure_count, count(eval(action=="lockout")) as lockout_count by sAMAccountName

| where failure_count >= 3 OR lockout_count > 0

[richgalloway]

The query looks OK, but its speed also depends on how many events it is processing. Try running the search more often over a smaller time range.

Try to reduce "indexes" to the smallest set of indexes that contain relevant Windows events.

Consider removing the lookup and hard-coding the relevant event codes.

index IN (indexes) sourcetype=xmlwineventlog sAMAccountName IN (_x*, x_*, lx*, hh*)
| eval action = case(event_code=x, "login_failure",
                     event_code=y, "lockout")
| stats count(eval(action=="login_failure")) as failure_count, count(eval(action=="lockout")) as lockout_count by sAMAccountName
| where failure_count >= 3 OR lockout_count > 0