Usernames Failed to Login against an IP Address | which other IP Addresses has that Username Failed to login against?

[JgTheGreat]

Hello,

I'm looking for a query, which looks for successful [ or unsuccessful ] brute force attempts, and then to take the Username that was [ or unsuccessfully/successfully logged in and then automatically return which other (if any) IP's that account was logged into.

Virtual beers and a high five on offer here 😄

KJG

[mayurr98]

index=your_index status=succes OR status=unsuccessful | stats values(srcip) by users status

If you give me sample event and field names associated with it I can give you proper query.

[mayurr98]

You need to edit these query according to naming of the field names in your data.

[JgTheGreat]

Query in original question - hope that this helps!