Hey this logic has few issues - (of course this is just my opinion) I made a test using kerbrute  below you can see results using SPL from documentation  enumeration took a while and we see events for 1h  1st I removed values(TargetUserName) as tried_accounts from stats commands becouse keep all of it doesn't make sense (64k in 2min) I recommend use and here defined how many examples we want to see  | eval tried_accounts =mvindex(tried_accounts , 0, 9)   2nd  isOutlier - wouldn't trigger when we will run scan and test massive number of users and generally environment are pretty quiet like on upper screens  the reason is in this logic  | eval upperBound=(comp_avg+comp_std*3) scanner generally us similar number tests per minute  (in my case it was 35k average and standard deviation was equal 3,3k)  based on that we scan average 70k per 2min and standard deviation I've got almost 10k  in results to get  Outlier I should see 100k+ account within 2min but scanner never crossed 80k  ... View more