Hi,
I'm create search query to monitor when 3 users create accounts in an hour:
index=* sourcetype="WinEventLog:Security" EventCode=4720
| stats count as total_accounts by host
| where total_accounts >=3
| timechart span=1h sum(total_accounts)
| eval time_range=timeRange("YYYY-MM-DD hh:mm:ss", "<start-time>", "<end-time>")
