Hi,
I have a failed logon search which includes:
| stats count by user, ComputerName
|search count >3 earliest=now() latest=-5m
Which shows me when a user has tried to log onto a particular box more than 3x in the last 5 minutes. I dont really want to be constantly running this search though!
Can anyone provide some pointers on how to do a search which shows more than 3x attempts within any 5 min period so that i could search a 24 hour period and it would display all the times users tried to logon to any given server more than 3x within a 5min period? Hopefully that makes sense!
I'm reading through the search reference, but i'm not really finding something that does the trick.
Appreciating any assistance.
↧