Signal - multiple login failure from same user

[probson (Philip Robson)]

Hi,

You could use a threshold rule:

Hopefully the image works. Query = event.code:4625 and field is user.name

Can also use EQL in 7.10 (my rule is filtering is looking more for remote login failures rather than monday morning people forgetting how to use a keyboard pre coffee)

sequence by source.ip with maxspan=300s
      [ authentication where event.action:"logon-failed" and source.ip != "127.0.0.1"  and source.ip != null ] by user.name
      [ authentication where event.action:"logon-failed" and source.ip != "127.0.0.1" and source.ip != null ] by user.name
      [ authentication where event.action:"logon-failed" and source.ip != "127.0.0.1" and source.ip != null ] by user.name