Create Dashboard for 15 failed logon from AD in 10 Min

[Majid_Att]

Hi Guys,
we would like to enable Account Lockout in Active Directory with this policy: 15 failed logon in 10 Min will be lockout.
Upfront we would like to simulate which user will be hit by this policy .
we use WinlogBeat to collect the data . The field we need to simulate is user.name together with Timestamp.
The challenges here is that we need to create kibana virtualization that sum up all the count for each user in 10 min in every minute .

we could see there is possibility called "moving average" but we can not make it work.
Could you please help up with that.

/Majid

[warkolm (Mark Walkom)]

Welcome to our community! We aren't all guys though

@Majid_Att

The challenges here is that we need to create kibana virtualization that sum up all the count for each user in 10 min in every minute .

What do you mean by that last part of that, "in 10 min in every minute"?

[Majid_Att]

@warkolm

last part of that, "in 10 min i

I mean in every minute must look to the next 10 minute to see if the sum of the count(Failed logon) for each individual user is more than 15 times.
For example let say I am looking the failed logon from 10:00 to 11:00
10:00 to 10:10 --> take a look at each individual user and sum up all the count for failed logon
10:01 to 10:11 --> take a look at each individual user and sum up all the count for failed logon
10:02 to 10:12 --> take a look at each individual user and sum up all the count for failed logon
...
11:00

I hope I could explain my issue .
Thanks for your time.

[warkolm (Mark Walkom)]

https://github.com/elastic/examples/tree/master/Alerting/Sample%20Watches has some examples you should be able to use.

[Majid_Att]

Thanks for the link. But I do not want any watcher or Alert. What I want is to create Dashboard and look for historical data. I will be appreciate if you could help with that.