If you have the Authentication data model configured you can use the following search to quickly find successful logins after 10 failed attempts!
|
1 2 3 4 5 |
| from datamodel:"Authentication"."Authentication" | search action=failure or action=success | reverse | streamstats window=0 current=true reset_after="(action=\"success\")" count as failure_count by src | where action="success" and failure_count > 10 |
