# Threshold Rule for Detecting Brute force Attacks
**URL:** https://discuss.elastic.co/t/threshold-rule-for-detecting-brute-force-attacks/245866
**Category:** Elastic Security
**Created:** [August 21, 2020, 7:20am UTC](https://discuss.elastic.co/t/threshold-rule-for-detecting-brute-force-attacks/245866 "2020-08-21T07:20:14Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@Ameer\_Mukadam](https://discuss.elastic.co/u/Ameer_Mukadam)
#### Post date: [August 21, 2020, 7:20am UTC](https://discuss.elastic.co/t/threshold-rule-for-detecting-brute-force-attacks/245866/1 "2020-08-21T07:20:14Z")
Hi, with the release of 7.9 I tried creating a threshold rule for detecting and alerting Windows Brute Force Attacks. The query is Event.code 4625 and the threshold field is host.name greater than equal to 5.
But the rule isn't detecting anything.
---
### Author:  [@threatpunter](https://discuss.elastic.co/u/threatpunter)
#### Post date: [August 21, 2020, 9:02pm UTC](https://discuss.elastic.co/t/threshold-rule-for-detecting-brute-force-attacks/245866/2 "2020-08-21T21:02:51Z")
Thanks for reaching out @Ameer_Mukadam. I have some questions for you to try and help identify the problem.
Are you using Winlogbeat to ship Windows security event logs to Elasticsearch? If so, what version of Winlogbeat are you using?
If you execute the following query in Discover under the `winlogbeat-*` index pattern, do you see 5 or more events within the time window that you specified in the threshold rule? This is to check that the events are present in order to trigger your rule.
`event.code:4625`
Does your rule look similar to my example in the screenshot below?
How have you configured the schedule for your rule? In my example below, I've set the interval to 5 minutes and the additional look-back time to 1 minute.
I'll keep an eye out for your response. Thanks
---
### Author:  [@Ameer\_Mukadam](https://discuss.elastic.co/u/Ameer_Mukadam)
#### Post date: [August 22, 2020, 5:38am UTC](https://discuss.elastic.co/t/threshold-rule-for-detecting-brute-force-attacks/245866/3 "2020-08-22T05:38:12Z")
Yes my rule looks exactly the same. Tuned the schedule and it started working thank you very much.
---
### Author:  [@threatpunter](https://discuss.elastic.co/u/threatpunter)
#### Post date: [August 22, 2020, 5:03pm UTC](https://discuss.elastic.co/t/threshold-rule-for-detecting-brute-force-attacks/245866/4 "2020-08-22T17:03:55Z")
Great! I'm glad you got it working 🙂
---
### Author:  [@siiman](https://discuss.elastic.co/u/siiman)
#### Post date: [October 1, 2020, 11:24am UTC](https://discuss.elastic.co/t/threshold-rule-for-detecting-brute-force-attacks/245866/5 "2020-10-01T11:24:41Z")
Hello Ameer,
how did you tuned the schedule? I have exactly the same problem and can't find any error.
I also use version 7.9.0
Thanks for your help.
kind regards
siiman
---
### Author:  [@Ameer\_Mukadam](https://discuss.elastic.co/u/Ameer_Mukadam)
#### Post date: [October 6, 2020, 7:55am UTC](https://discuss.elastic.co/t/threshold-rule-for-detecting-brute-force-attacks/245866/6 "2020-10-06T07:55:18Z")
Hey, I didn’t do anything specific suddenly it just started working.
---
### Author:  [@Frank\_Hassanabad](https://discuss.elastic.co/u/Frank_Hassanabad)
#### Post date: [October 7, 2020, 9:20pm UTC](https://discuss.elastic.co/t/threshold-rule-for-detecting-brute-force-attacks/245866/7 "2020-10-07T21:20:48Z")
Just throwing this out there @siiman and @Ameer_Mukadam about at least one reason why sometimes if you tweak the scheduling things start working when before they looked like they didn't. This might/might not be an explanation but it's good to know nonetheless for the future.
When you create a rule and set the schedule and then run it, the rule by default will look at the `@timestamp` for its queries to detect things from the scheduler. If your agents such as beats or endgame or etc... are sending events where the `@timestamp` is off because that computer sending the message has clock skew you're going to start to see this type of behavior where you're sometimes not detecting things between rule runs.
The additional look back time is used to account for some clock skew by intentionally doing a small overlap along with signal de-duplication between the overlaps. We have seen people change this value and then start to see signals occurring when before they might not have.
The worst offenders of the clock skew is that some systems run different log collectors/log proxies which happen to have received a batch of logs with timestamp already set to a past time but it basically processes them to Elastic Search in bursts or periodic times and then the clock skew issue deepens for people.
A feature we have if this is the case is to utilize the timestamp override we have and choose a field that you setup server side in a pipeline processor[1] to add a date time field of when it arrives within ES such as event.ingested:
Refs:
1. [https://www.elastic.co/guide/en/elasticsearch/reference/master/ingest-processors.html](https://www.elastic.co/guide/en/elasticsearch/reference/master/ingest-processors.html)
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 4, 2022, 8:10am UTC](https://discuss.elastic.co/t/threshold-rule-for-detecting-brute-force-attacks/245866/8 "2022-11-04T08:10:55Z")