Successful authentication after 3 failures

bilel_meddeb · June 9, 2021, 7:04pm

Hello,
I'm new in ELK

I want to create an alert if a windows user makes a successful login after he make 3 failed authentication

that's mean after 3 failed (4625 event id ) and 1 success (4624 event id ) he make alert

I use winlogbeat to collect log from windows machine

system · July 7, 2021, 7:04pm

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Elasticsearch query multiple logs Kibana elastic-stack-alerting	2	437	August 9, 2020
Elast Alert Elasticsearch	2	451	March 23, 2020
Watch for Login failure in windows events with watcher Elasticsearch elastic-stack-alerting	2	472	August 29, 2019
Watcher alerts for failed logons Elasticsearch	8	5187	August 22, 2017
Only create an alert when the query gets three hits from the same device Elasticsearch elastic-stack-alerting	4	733	December 30, 2019