# Watcher: Conditional action for failed login event

**URL:** <https://discuss.elastic.co/t/watcher-conditional-action-for-failed-login-event/234652>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [May 28, 2020, 5:14am UTC](https://discuss.elastic.co/t/watcher-conditional-action-for-failed-login-event/234652 "2020-05-28T05:14:20Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Tirtharaj\_Karbotkar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tirtharaj_karbotkar/32/69244_2.png) [@Tirtharaj\_Karbotkar](https://discuss.elastic.co/u/Tirtharaj_Karbotkar)\
**Post date:** [May 28, 2020, 5:14am UTC](https://discuss.elastic.co/t/watcher-conditional-action-for-failed-login-event/234652/1 "2020-05-28T05:14:20Z")

</div>

Hi,

I have one watcher which is checking for user login events after every 1 minute. Now i have issues in filtering the results in following manner,

1. I want to get only the failed login events (exclude successful login) . Here the "event.type" field gives the event message that is either Authentication success or authentication failed.
2. Alert only if the login request is from outside host country ( example: alert if the request source country is other than US). In below watcher "source.geo.country\_name" field gives the value of country.

```auto
        {
          "trigger": {
            "schedule": {
              "interval": "1m"
            }
          },
          "input": {
            "search": {
              "request": {
                "search_type": "query_then_fetch",
                "indices": [
                  "auditbeat-*"
                ],
                "rest_total_hits_as_int": true,
                "body": {
                  "size": 0,
                  "query": {
                    "bool": {
                      "filter": [
                        {
                          "range": {
                            "@timestamp": {
                              "from": "now-1m",
                              "to": "now"
                            }
                          }
                        },
                        {
                          "term": {
                            "event.action": "user_login"
                          }
                        }
                      ]
                    }
                  },
                  "aggs": {
                    "authmsg": {
                      "terms": {
                        "field": "event.type",
                        "size": 5
                      },
                      "aggs": {
                        "country": {
                          "terms": {
                            "field": "source.geo.country_name",
                            "size": 5
                          }
                        }
                      }
                    }
                  }
                }
              }
            }
          }

         below is the response for above query 

        "aggregations" : {
                "authmsg" : {
                  "doc_count_error_upper_bound" : 0,
                  "sum_other_doc_count" : 0,
                  "buckets" : [
                    {
                      "country" : {
                        "doc_count_error_upper_bound" : 0,
                        "sum_other_doc_count" : 0,
                        "buckets" : [
                          {
                            "doc_count" : 1,
                            "key" : "Canada"
                          }
                        ]
                      },
                      "doc_count" : 1,
                      "key" : "authentication_failed"
                    }
                  ]
                }
              }
            }

```

I tried few solutions from other post but no luck. Can anyone help me to fix this or point to example similar above request.

---

<div class="post-metadata">

**Author:** ![Tirtharaj\_Karbotkar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tirtharaj_karbotkar/32/69244_2.png) [@Tirtharaj\_Karbotkar](https://discuss.elastic.co/u/Tirtharaj_Karbotkar)\
**Post date:** [May 29, 2020, 6:16am UTC](https://discuss.elastic.co/t/watcher-conditional-action-for-failed-login-event/234652/2 "2020-05-29T06:16:47Z")

</div>

hello...  
i was able to achieve first requirement i.e. "alerts for only failed login attempts" by adding below filter after the `event.action` filter..

```
{
                  "terms": {
                    "event.type": [
                      "authentication_failure"
                    ]
                  }
                }

```

can anyone help me with the second point: i.e. Alert only if the login request is from outside host country.

---

<div class="post-metadata">

**Author:** ![Tirtharaj\_Karbotkar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tirtharaj_karbotkar/32/69244_2.png) [@Tirtharaj\_Karbotkar](https://discuss.elastic.co/u/Tirtharaj_Karbotkar)\
**Post date:** [June 3, 2020, 11:10am UTC](https://discuss.elastic.co/t/watcher-conditional-action-for-failed-login-event/234652/3 "2020-06-03T11:10:59Z")

</div>

Hi,

It will be great if anyone help me out here. Kindly let me know if anyone requires more info.

---

<div class="post-metadata">

**Author:** ![Tirtharaj\_Karbotkar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tirtharaj_karbotkar/32/69244_2.png) [@Tirtharaj\_Karbotkar](https://discuss.elastic.co/u/Tirtharaj_Karbotkar)\
**Post date:** [June 5, 2020, 7:37am UTC](https://discuss.elastic.co/t/watcher-conditional-action-for-failed-login-event/234652/4 "2020-06-05T07:37:04Z")

</div>

Hi Admins,

Can anyone please help me here.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 3, 2020, 7:37am UTC](https://discuss.elastic.co/t/watcher-conditional-action-for-failed-login-event/234652/5 "2020-07-03T07:37:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.