[Query] invalid login
M
Matti Zayas
Copy and paste into SIEM Search Bar
SELECT new_logs.uuid, new_logs.organization_id, new_logs.event_provider AS event_provider, new_logs.event_code_string AS ecs_event_code, new_logs.host_hostname AS host_hostname, new_logs.user_name AS user_name, new_logs.source_ip AS source_ip, new_logs.message FROM new_logs AS logs WHERE new_logs.account_id = 2870 AND new_logs.log_source_id = 3685373 AND new_logs.uuid >= '019f83de-1ec0-7000-8000-000000000000' AND new_logs.uuid < '019f84b9-d8c0-7000-8000-000000000000' AND (new_logs.message ILIKE '%invalid%login%' OR new_logs.message ILIKE '%login%fail%' OR new_logs.message ILIKE '%authentication%fail%' OR new_logs.message ILIKE '%auth%fail%') ORDER BY new_logs.uuid DESC LIMIT 100