Hi Team can i ask how to create a login failed rule on kibana? i want to monitor the users who failed logging in into their computer.
Hi @Renz_Aguilar and welcome to the community!
It sounds like you want to know how to configure Audit Logging in Kibana that will allow you to record and monitor failed authorization attempts.
The docs describe the step-by-step process to get setup, after which you should be able to create the rule as shown in the screenshot.
I'm not sure what version of Kibana you're running or your subscription level. The link to the docs are for the 7.15 version and Audit logging requires a subscription (paid license).
