Hi, I'm create search query to monitor when 3 users create accounts in an hour: index=* sourcetype="WinEventLog:Security" EventCode=4720 | stats count as total_accounts by host | where total_accounts >=3 | timechart span=1h sum(total_accounts) | eval time_range=timeRange("YYYY-MM-DD hh:mm:ss", "<start-time>", "<end-time>")   ... View more