# How to create a rule with aggregation
**URL:** https://discuss.elastic.co/t/how-to-create-a-rule-with-aggregation/269023
**Category:** SIEM
**Tags:** elastic-stack-security
**Created:** [April 1, 2021, 11:13am UTC](https://discuss.elastic.co/t/how-to-create-a-rule-with-aggregation/269023 "2021-04-01T11:13:51Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)
#### Post date: [April 1, 2021, 11:13am UTC](https://discuss.elastic.co/t/how-to-create-a-rule-with-aggregation/269023/1 "2021-04-01T11:13:51Z")
Hello,
I would like to create a rule where I can detect brute force attack
For example: in `winlogbeat-*` and `auditbeat-*` where `event.action` == `logon-failed`, aggregation by `user.name` , and if it's more than 10, it creates an alerts
My problem, is that I don't know how to make the aggregation by `user.name`
Could you tell me please which type of rule I can use, and is it possible to make aggregation or I can just do it by using watcher script
Thanks for your help !
---
### Author:  [@jamesspi](https://discuss.elastic.co/u/jamesspi)
#### Post date: [April 2, 2021, 7:32am UTC](https://discuss.elastic.co/t/how-to-create-a-rule-with-aggregation/269023/2 "2021-04-02T07:32:15Z")
Hey @TheHunter1 ,
You can use the threshold detection type for this. I put a similar example in this screenshot:
It's very close to the use case you're describing. You can just adjust the index patterns as you wish, as well as the logic (in my case it's looking for 10 or more attempts from the same source ip address, to the same host, with 5 or more unique user names.)
James
---
### Author:  [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)
#### Post date: [April 4, 2021, 5:43pm UTC](https://discuss.elastic.co/t/how-to-create-a-rule-with-aggregation/269023/3 "2021-04-04T17:43:19Z")
Thanks a lot for your answer @jamesspi ,
I configured it to look for 10 or more attemps from the same source.ip address to the same host and using the same user.name and it's working as expected :
I just have one more question.
After detecting the brute force, I would like to know more information about the alert (source.ip, user.name ..etc) in the email alerting
Could you tell me please how can I send those information in the email ?
Thanks for your help.
---
### Author:  [@jamesspi](https://discuss.elastic.co/u/jamesspi)
#### Post date: [April 5, 2021, 11:14am UTC](https://discuss.elastic.co/t/how-to-create-a-rule-with-aggregation/269023/4 "2021-04-05T11:14:33Z")
Hey @TheHunter1 ,
Glad that worked for you.
Usually, you would be able to use `{{context.alerts}}` for this, like so:
```auto
{{#context.alerts}}
User: {{user.name}}
Source IP: {{source.ip}}
{{/context.alerts}}
```
However, there is a bug in `7.12` at the moment which is preventing this for threshold alerts. The field names containing the results are different to the other alerts (as these are based on aggregations). A fix is coming ASAP!
Thanks,
James
---
### Author:  [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)
#### Post date: [April 6, 2021, 7:57am UTC](https://discuss.elastic.co/t/how-to-create-a-rule-with-aggregation/269023/5 "2021-04-06T07:57:22Z")
Thanks a lot for much all these precious information 😊
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 4, 2021, 7:57am UTC](https://discuss.elastic.co/t/how-to-create-a-rule-with-aggregation/269023/6 "2021-05-04T07:57:29Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.