| bin _time span=10m aligntime=latest   ... View more

Hi @Mckechnie, you want to identify a brute force attach, there are many samples of this Use Case in the Splunk Security Essentials App (https://splunkbase.splunk.com/app/3435), but anyway, you could run something like this: index=dirsvcs_seceventlogs source="wineventlog:security" (EventCode=4625 OR EventCode=4624) | stats count(eval(EventCode="4624")) AS logins count(eval(EventCode="4625")) AS logfails BY host cs_username | where logfails>10 the final where command is the threshold that you can configure. Eventually, you can configure if the brute force failed or reached adding a filter on "logins" Ciao. Giuseppe ... View more