# Create Dashboard for 15 failed logon from AD in 10 Min
**URL:** https://discuss.elastic.co/t/create-dashboard-for-15-failed-logon-from-ad-in-10-min/245877
**Category:** Kibana
**Created:** [August 21, 2020, 8:29am UTC](https://discuss.elastic.co/t/create-dashboard-for-15-failed-logon-from-ad-in-10-min/245877 "2020-08-21T08:29:47Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@Majid\_Att](https://discuss.elastic.co/u/Majid_Att)
#### Post date: [August 21, 2020, 8:29am UTC](https://discuss.elastic.co/t/create-dashboard-for-15-failed-logon-from-ad-in-10-min/245877/1 "2020-08-21T08:29:47Z")
Hi Guys,
we would like to enable Account Lockout in Active Directory with this policy: 15 failed logon in 10 Min will be lockout.
Upfront we would like to simulate which user will be hit by this policy .
we use WinlogBeat to collect the data . The field we need to simulate is user.name together with Timestamp.
The challenges here is that we need to create kibana virtualization that sum up all the count for each user in 10 min in every minute .
we could see there is possibility called "moving average" but we can not make it work.
Could you please help up with that.
/Majid
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [August 23, 2020, 11:08pm UTC](https://discuss.elastic.co/t/create-dashboard-for-15-failed-logon-from-ad-in-10-min/245877/2 "2020-08-23T23:08:43Z")
Welcome to our community! 😃 We aren't all guys though 🙂
> [@Majid\_Att](#):
>
> The challenges here is that we need to create kibana virtualization that sum up all the count for each user in 10 min in every minute .
What do you mean by that last part of that, _"in 10 min in every minute"_?
---
### Author:  [@Majid\_Att](https://discuss.elastic.co/u/Majid_Att)
#### Post date: [August 24, 2020, 6:27am UTC](https://discuss.elastic.co/t/create-dashboard-for-15-failed-logon-from-ad-in-10-min/245877/3 "2020-08-24T06:27:49Z")
> [@warkolm](#):
>
> last part of that, _"in 10 min i_
I mean in every minute must look to the next 10 minute to see if the sum of the count(Failed logon) for each individual user is more than 15 times.
For example let say I am looking the failed logon from 10:00 to 11:00
10:00 to 10:10 --\> take a look at each individual user and sum up all the count for failed logon
10:01 to 10:11 --\> take a look at each individual user and sum up all the count for failed logon
10:02 to 10:12 --\> take a look at each individual user and sum up all the count for failed logon
...
11:00
I hope I could explain my issue .
Thanks for your time.
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [August 25, 2020, 12:01am UTC](https://discuss.elastic.co/t/create-dashboard-for-15-failed-logon-from-ad-in-10-min/245877/4 "2020-08-25T00:01:17Z")
[https://github.com/elastic/examples/tree/master/Alerting/Sample%20Watches](https://github.com/elastic/examples/tree/master/Alerting/Sample%20Watches) has some examples you should be able to use.
---
### Author:  [@Majid\_Att](https://discuss.elastic.co/u/Majid_Att)
#### Post date: [August 25, 2020, 12:51pm UTC](https://discuss.elastic.co/t/create-dashboard-for-15-failed-logon-from-ad-in-10-min/245877/5 "2020-08-25T12:51:07Z")
Thanks for the link. But I do not want any watcher or Alert. What I want is to create Dashboard and look for historical data. I will be appreciate if you could help with that.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 22, 2020, 12:51pm UTC](https://discuss.elastic.co/t/create-dashboard-for-15-failed-logon-from-ad-in-10-min/245877/6 "2020-09-22T12:51:10Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.