# Watcher Threshold Script for Failed Logon Attempts

**URL:** <https://discuss.elastic.co/t/watcher-threshold-script-for-failed-logon-attempts/222195>\
**Category:** Elasticsearch\
**Created:** [March 5, 2020, 4:35am UTC](https://discuss.elastic.co/t/watcher-threshold-script-for-failed-logon-attempts/222195 "2020-03-05T04:35:49Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![ted1621](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ted1621/32/63595_2.png) [@ted1621](https://discuss.elastic.co/u/ted1621)\
**Post date:** [March 5, 2020, 4:35am UTC](https://discuss.elastic.co/t/watcher-threshold-script-for-failed-logon-attempts/222195/1 "2020-03-05T04:35:49Z")

</div>

Hi I am trying to get a watcher threshold alert set up. I would like to run the watch every 5 minutes, against the winlogbeat-\* index. I would like the alert to trigger when there are 10 failed logon attempts in 1 minute. Here is what I have currently if someone could assist.

{  
"trigger": {  
"schedule": {  
"interval": "5m"  
}  
},  
"input": {  
"search": {  
"request": {  
"search\_type": "query\_then\_fetch",  
"indices": [  
"winlogbeat-\*"  
],  
"rest\_total\_hits\_as\_int": true,  
"body": {  
"size": 0,  
"query": {  
"bool": {  
"filter": {  
"range": {  
"@timestamp": {  
"gte": "{{ctx.trigger.scheduled\_time}}||-5m",  
"lte": "{{ctx.trigger.scheduled\_time}}",  
"format": "strict\_date\_optional\_time||epoch\_millis"  
}  
}  
}  
}  
},  
"aggs": {  
"bucketAgg": {  
"terms": {  
"field": "4625",  
"size": 5,  
"order": {  
"\_count": "desc"  
}  
}  
}  
}  
}  
}  
}  
},  
"condition": {  
"script": {  
"source": "ArrayList arr = ctx.payload.aggregations.bucketAgg.buckets; for (int i = 0; i \< arr.length; i++) { if (arr[i].doc\_count \> params.threshold) { return true; } } return false;",  
"lang": "painless",  
"params": {  
"threshold": 10  
}  
}  
},  
"actions": {  
"email\_1": {  
"email": {  
"profile": "standard",  
"to": [  
"[shrimp@bubbagump.net](mailto:shrimp@bubbagump.net)"  
],  
"subject": "Watch [{{ctx.metadata.name}}] has exceeded the threshold",  
"body": {  
"text": "Threshold Alert for any event code with over 10 events in 5 minutes"  
}  
}  
}  
},  
"transform": {  
"script": {  
"source": "HashMap result = new HashMap(); ArrayList arr = ctx.payload.aggregations.bucketAgg.buckets; ArrayList filteredHits = new ArrayList(); for (int i = 0; i \< arr.length; i++) { HashMap filteredHit = new HashMap(); filteredHit.key = arr[i].key; filteredHit.value = arr[i].doc\_count; if (filteredHit.value \> params.threshold) { filteredHits.add(filteredHit); } } result.results = filteredHits; return result;",  
"lang": "painless",  
"params": {  
"threshold": 10  
}  
}  
},  
"metadata": {  
"xpack": {  
"type": "json"  
},  
"name": "failed\_logon\_test alert"  
}  
}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 2, 2020, 4:35am UTC](https://discuss.elastic.co/t/watcher-threshold-script-for-failed-logon-attempts/222195/2 "2020-04-02T04:35:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.