# Signal - multiple login failure from same user

**URL:** https://discuss.elastic.co/t/signal-multiple-login-failure-from-same-user/255517
**Category:** SIEM
**Created:** [November 16, 2020, 11:51am UTC](https://discuss.elastic.co/t/signal-multiple-login-failure-from-same-user/255517 "2020-11-16T11:51:39Z")
**Posts on this page:** 1
**Showing post:** 2

<div class="post-metadata">

### Author: ![probson](https://avatars.discourse-cdn.com/v4/letter/p/e47c2d/32.png) [@probson](https://discuss.elastic.co/u/probson)
#### Post date: [November 16, 2020, 12:24pm UTC](https://discuss.elastic.co/t/signal-multiple-login-failure-from-same-user/255517/2 "2020-11-16T12:24:57Z")

</div>

Hi,

You could use a threshold rule:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/b/eb158b4ecca85a1fa2a8a4c83e6dc60f2b6fc645.png)

Hopefully the image works. Query = event.code:4625 and field is user.name

Can also use EQL in 7.10 (my rule is filtering is looking more for remote login failures rather than monday morning people forgetting how to use a keyboard pre coffee)

```auto
sequence by source.ip with maxspan=300s
      [authentication where event.action:"logon-failed" and source.ip != "127.0.0.1" and source.ip != null] by user.name
      [authentication where event.action:"logon-failed" and source.ip != "127.0.0.1" and source.ip != null] by user.name
      [authentication where event.action:"logon-failed" and source.ip != "127.0.0.1" and source.ip != null] by user.name

```

---

_[View the full topic](https://discuss.elastic.co/t/signal-multiple-login-failure-from-same-user/255517)._