# Signal - multiple login failure from same user

**URL:** https://discuss.elastic.co/t/signal-multiple-login-failure-from-same-user/255517
**Category:** SIEM
**Created:** [November 16, 2020, 11:51am UTC](https://discuss.elastic.co/t/signal-multiple-login-failure-from-same-user/255517 "2020-11-16T11:51:39Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![jancodenew](https://avatars.discourse-cdn.com/v4/letter/j/87869e/32.png) [@jancodenew](https://discuss.elastic.co/u/jancodenew)
#### Post date: [November 16, 2020, 11:51am UTC](https://discuss.elastic.co/t/signal-multiple-login-failure-from-same-user/255517/1 "2020-11-16T11:51:39Z")

</div>

Please help me to create a signal for below logic.

Alert if there is more than 3 login failure from same user in last 5min.

I have mentioned below the watcher query written for same above logic.  
“query”: {  
“bool”: {  
“must”: [ {  
“query\_string”: {  
“fields”: [  
“event.type”],  
“query”: “failed login”  
}},  
{“range”:{  
“@timestamp”: { “gte”: “now-5m”}}}]  
}},  
“aggs”: {  
“name”:{  
“fields”: “user.name”,  
“min\_doc\_count”: 3  
}}}

---

<div class="post-metadata">

### Author: ![probson](https://avatars.discourse-cdn.com/v4/letter/p/e47c2d/32.png) [@probson](https://discuss.elastic.co/u/probson)
#### Post date: [November 16, 2020, 12:24pm UTC](https://discuss.elastic.co/t/signal-multiple-login-failure-from-same-user/255517/2 "2020-11-16T12:24:57Z")

</div>

Hi,

You could use a threshold rule:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/b/eb158b4ecca85a1fa2a8a4c83e6dc60f2b6fc645.png)

Hopefully the image works. Query = event.code:4625 and field is user.name

Can also use EQL in 7.10 (my rule is filtering is looking more for remote login failures rather than monday morning people forgetting how to use a keyboard pre coffee)

```auto
sequence by source.ip with maxspan=300s
      [authentication where event.action:"logon-failed" and source.ip != "127.0.0.1" and source.ip != null] by user.name
      [authentication where event.action:"logon-failed" and source.ip != "127.0.0.1" and source.ip != null] by user.name
      [authentication where event.action:"logon-failed" and source.ip != "127.0.0.1" and source.ip != null] by user.name

```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 14, 2020, 12:25pm UTC](https://discuss.elastic.co/t/signal-multiple-login-failure-from-same-user/255517/3 "2020-12-14T12:25:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.