I need to alert for 20 consecutive failed logon attempts within a 30 minute time period | Product Discussions

Will_Pratt · 2022-10-19T22:23:09Z

We have a team that would like to get alerted on 20 consecutive failed logon attempts from a single account on any of our SQL servers in a 30 minute time frame. I started out using the eventsource for errors in the security event log and set it watch for EventID 4625. I am not very savvy with groovy and am now looking at setting up with a Powershell script via a new Datasource but I am having some trouble with it. If anyone has any ideas on how to best script this I would greatly appreciate the help!

MoreDiscussions

I need to alert for 20 consecutive failed logon attempts within a 30 minute time period | Product Discussions | LogicMonitor Community