Forum Discussion
Cole_McDonald
Professor
5 years agoI've implemented this in the past as a dataSource for tracking number of failed connection attempts against a server over a 5 minute period. Powershell that grabs the last 5 minutes of 4625 from the windows security log where the message contains the status for bad username or bad password. It just returns a count rather than individual events. This let me drive a NOC widget of devices to show brute force intrusion attempts.
This could potentially be added like a cluster alert using the existing eventSource though and help to combine individual events into a single actionable alert to reduce noise.
This is a super old thread, but I just came across it.... so I'll add my $.02
Related Content
- 18 days ago
- 2 months ago
- 2 years ago