Search for recurring events over multiple time spans

[neilsmith2]

Hi, looking for guidance please on how to alert on recurring auth events over multiple time spans, but I can't get my head around how to construct the search terms

for example:

- user account is locked out =>X per hour for =>X consecutive hours

- user has =>X login failures in an hour for  =>X consecutive  hours 

Hope that makes sense! TIA

[ITWhisperer]

You can set up a report which counts the instances by the hour and then use something like streamstats to determine whether the hours with high counts are consecutive.