Hi again, Below is the query that I eventually came up with. I needed it to only fire an alert if a user+host combination had a certain number of failed logon attempts followed by a successful event within 10 minutes. Another thing I noticed is that event ID 4625 can also be logged in the Application log (I don't recall what logs it), and that Windows 2008R2 and Windows 2012R2 call the name of the file different names: Logfile and LogName, hence that addition to the beginning of the query. Hope this is helpful to someone else. ("Logfile=Security" OR "LogName=Security") AND (EventCode=4625 OR EventCode=4624) | eval username=mvindex(Account_Name, 1) | streamstats count(eval(match(EventCode, "4625"))) as Failed, count(eval(match(EventCode, "4624"))) as Success reset_on_change=true by username | eval alert=if(Failed>3, "yes", "no") | where Failed > 3 | eval newname=username, newhost=host | where (Success > 1 AND host=newhost AND username=newname) | eval end_alert="YES" | table _time, username, host, Failed, Success, alert, newname, newhost, end_alert ... View more