for failed auth monitoring i usually start with three panels: failed logins by hour (timechart), top source IPs (stats count by src_ip), and top targeted users (stats count by user). if you're using CIM normalized fields its pretty straightforward. layout wise i do the timechart full width on top, then the two tables side by side below it ... View more