# O365 Logs - Single failed log in attempt multiple logs generated

**URL:** <https://discuss.elastic.co/t/o365-logs-single-failed-log-in-attempt-multiple-logs-generated/382237>\
**Category:** SIEM\
**Created:** [September 26, 2025, 3:08am UTC](https://discuss.elastic.co/t/o365-logs-single-failed-log-in-attempt-multiple-logs-generated/382237 "2025-09-26T03:08:37Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![rey\_espinosa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rey_espinosa/32/145167_2.png) [@rey\_espinosa](https://discuss.elastic.co/u/rey_espinosa)\
**Post date:** [September 26, 2025, 3:08am UTC](https://discuss.elastic.co/t/o365-logs-single-failed-log-in-attempt-multiple-logs-generated/382237/1 "2025-09-26T03:08:37Z")

</div>

Is it possible that a single failed log in attempt can generate multiple logs and the only difference it a millisecond on their timestamp that looks like automated attack ?

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [September 29, 2025, 12:51am UTC](https://discuss.elastic.co/t/o365-logs-single-failed-log-in-attempt-multiple-logs-generated/382237/2 "2025-09-29T00:51:21Z")

</div>

Hi @rey_espinosa welcome to the community.

Apologies, Could you provide a little more detail? It's not clear exactly what you're talking about.

Are you referring to a failed login to elasticsearch and you're looking at the audit logs?

What exactly are you referring to and what logs are you referring to and could you provide some samples ..

---

<div class="post-metadata">

**Author:** ![rey\_espinosa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rey_espinosa/32/145167_2.png) [@rey\_espinosa](https://discuss.elastic.co/u/rey_espinosa)\
**Post date:** [September 29, 2025, 6:35am UTC](https://discuss.elastic.co/t/o365-logs-single-failed-log-in-attempt-multiple-logs-generated/382237/3 "2025-09-29T06:35:51Z")

</div>

yes, when i look at 0365 environment and checking the logs it seems like there is an automated attack due to multiple failed logs i`ve seen`, but when i`ask the client they says then only made 1 failed attempt

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 27, 2025, 6:36am UTC](https://discuss.elastic.co/t/o365-logs-single-failed-log-in-attempt-multiple-logs-generated/382237/4 "2025-10-27T06:36:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.