Hi @jalen1331, ok, I confirm both my opinions even if you don't want to hear them, maybe because they are correct. Anyway, could you better describe your requirements? what do you mean with "a way to mitigate my login failures"? if you want to identify logfails in active directory, you have to run a simple search like this: index=wineventlog EventCode=4625 But you didn't describe what you want to know: a threshold for logfails, the source of logfails, what else? Ciao. Giuseppe ... View more