Hi
im wondering if i can create a match in pipeline that match if a failed login event id occurs 5 times in 5 min AND one success login then create a match
i know u can do it in enterprise version but cant use it here…
like this
(event_id:4625 AND keywords:“Audit Failure”)
Threshold = 6 matches within 5min)
AND
(event_id:4624 AND keywords:“Audit Success”)
Threshold = 1 match within 5min)
Alarm will be created when there will be at least 6 failed logon attempts and one successful logon within 5 min time span
that is only doable with the correlation engine … what is enterprise feature.
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.