Are you using the correct range? Also try to change the last octet from 0 t0 1 Check your network range CIDR notation in here: https://www.ipaddressguide.com/cidr ... View more

I should think it's a matter of testing the UserAgent value. index=appext_o365 `o365_management_activity` Workload=AzureActiveDirectory UserAuthenticationMethod=* status=failure UserAgent!="BAV2ROPC" | stats count earliest(_time) AS firstTime latest(_time) AS lastTime values(UserAuthenticationMethod) AS UserAuthenticationMethod values(UserAgent) AS UserAgent values(status) AS status values(src_ip) AS src_ip by user | where count > 10 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_excessive_authentication_failures_alert_filter` ... View more

This app does what you need https://splunkbase.splunk.com/app/4240/   ... View more