I'm doing a search for invalid logons for our vpn logs. But I want the search results to return when the invalid attempts reach 5 or more from the same user but I don't know the user ahead of time. If a user has 5 or more invalid logon attempts, I want it to alert. Right now I can get all the invalid attempts from all users in the time frame I'm looking at but I don't know how to narrow that down to just alerting on if one user has 5 or more attempts. Please help. Thanks.
Have you tried attaching the following to your search (you will need to replace user with the field that represents your failed user)
"your search here" | stats count by user | search count > 4
This should filter the failed users to only show ones that have failed 5 times or more.
travis.
Have you tried attaching the following to your search (you will need to replace user with the field that represents your failed user)
"your search here" | stats count by user | search count > 4
This should filter the failed users to only show ones that have failed 5 times or more.
travis.
Thanks, that's what I was looking for, it worked.