# Watcherで連続データに対する検知をする方法

**URL:** https://discuss.elastic.co/t/watcher/282482
**Category:** 日本語による質問・議論はこちら
**Created:** [August 25, 2021, 11:12am UTC](https://discuss.elastic.co/t/watcher/282482 "2021-08-25T11:12:06Z")
**Posts on this page:** 1
**Showing post:** 2

<div class="post-metadata">

### Author: ![Koji\_Kawamura](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/koji_kawamura/32/93938_2.png) [@Koji\_Kawamura](https://discuss.elastic.co/u/Koji_Kawamura)
#### Post date: [September 1, 2021, 1:50am UTC](https://discuss.elastic.co/t/watcher/282482/2 "2021-09-01T01:50:15Z")

</div>

@t-nakata さん、

Watcher でなくて良いのであれば、最近だと Elastic Security の検知ルールとして実装する方がこの手の検知は簡単に実装できます。

単純に一定時間内におけるログイン失敗回数で判定するなら Threshold、ご質問のように、成功せず失敗の連続を検知したいのであれば EQL が適切かと思います。

> **[Example: Detect threats with EQL | Elasticsearch Guide \[7.14\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/7.14/eql-ex-threat-detection.html)**

同様の質問があったのでご参考にしてください。

> [@Signal - multiple login failure from same user](https://discuss.elastic.co/t/signal-multiple-login-failure-from-same-user/255517/2):
>
> Hi, You could use a threshold rule: Hopefully the image works. Query = event.code:4625 and field is user.name Can also use EQL in 7.10 (my rule is filtering is looking more for remote login failures rather than monday morning people forgetting how to use a keyboard pre coffee) sequence by source.ip with maxspan=300s [authentication where event.action:"logon-failed" and source.ip != "127.0.0.1" and source.ip != null] by user.name [ authentication where event.action:"…

---

_[View the full topic](https://discuss.elastic.co/t/watcher/282482)._