# Detection rule: Failed login attempts

**URL:** https://discuss.elastic.co/t/detection-rule-failed-login-attempts/274590
**Category:** SIEM
**Created:** [June 1, 2021, 7:23am UTC](https://discuss.elastic.co/t/detection-rule-failed-login-attempts/274590 "2021-06-01T07:23:25Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![bnk](https://avatars.discourse-cdn.com/v4/letter/b/65b543/32.png) [@bnk](https://discuss.elastic.co/u/bnk)
#### Post date: [June 1, 2021, 7:23am UTC](https://discuss.elastic.co/t/detection-rule-failed-login-attempts/274590/1 "2021-06-01T07:23:25Z")

</div>

Hi, I've created my own detection rule for employees failed login attempts. It does work but when signal comes to Security -\> Detection dashboard, it do not show user.name or host.name.  
This is screen shot of my rule:

 ![Screenshot from 2021-06-01 10-17-01](https://us1.discourse-cdn.com/elastic/original/3X/f/f/ff7eb1832912cc44ed36e1eb92c1051d03559977.png)  
Is there a way to update my rule that it would show user.name or host.name?  
This is a screen shot of fired signal:  
 ![Screenshot from 2021-06-01 10-22-05](https://us1.discourse-cdn.com/elastic/original/3X/3/b/3be5d1bcadc98c12c652d5136b7e1c37e1cb12d9.png)

Regards  
Ema

---

<div class="post-metadata">

### Author: ![probson](https://avatars.discourse-cdn.com/v4/letter/p/e47c2d/32.png) [@probson](https://discuss.elastic.co/u/probson)
#### Post date: [June 1, 2021, 2:54pm UTC](https://discuss.elastic.co/t/detection-rule-failed-login-attempts/274590/2 "2021-06-01T14:54:18Z")

</div>

only if you use user.name or host.name in the group by and that is dependant on what you want to do

Usually group by host.name or source.ip (depending on the logs) so that you are looking from multiple failed logins from a device. If you look for multiple failed logins full stop you might lots of failed logins come monday morning at 9am for example. This is more for scatter of user names.

If you group by user.name then your looking more for brute force attempts.

---

<div class="post-metadata">

### Author: ![bnk](https://avatars.discourse-cdn.com/v4/letter/b/65b543/32.png) [@bnk](https://discuss.elastic.co/u/bnk)
#### Post date: [June 2, 2021, 10:51am UTC](https://discuss.elastic.co/t/detection-rule-failed-login-attempts/274590/3 "2021-06-02T10:51:35Z")

</div>

Thank you @probson. I adjusted the detection rule according to your advice and I'll wait for the results.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 30, 2021, 10:52am UTC](https://discuss.elastic.co/t/detection-rule-failed-login-attempts/274590/4 "2021-06-30T10:52:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.