How to Create Login failed Rule

Hi Team can i ask how to create a login failed rule on kibana? i want to monitor the users who failed logging in into their computer.

Hi @Renz_Aguilar and welcome to the community!
It sounds like you want to know how to configure Audit Logging in Kibana that will allow you to record and monitor failed authorization attempts.
The docs describe the step-by-step process to get setup, after which you should be able to create the rule as shown in the screenshot.
I'm not sure what version of Kibana you're running or your subscription level. The link to the docs are for the 7.15 version and Audit logging requires a subscription (paid license).


Hi i want to collect the user login failure of the users, these are my rule settings but still i cant get failed login logs, please help thank you.