How to use Windows event logs to alert for the failed attempts less than 5 occurring for every hour?

[kiran331]

Slow and Low attack? How to use Windows event logs to alert for the failed attempts less than 5 occurring for every hour?

index=wineventlog  EventCode=4625

[troyward]

Might consider using transactions.

index=wineventlog  EventCode=4625
| transaction <username field> maxspan=1h
| where eventcount < 5
| table <username> first last eventcount