Get an overview of 401 and 403 errors, an increase might be an IoC.

<code>index=* sourcetype="ms:iis:default" sc_status=401 OR sc_status=403 |table _time, sc_status, sc_substatus, uri_path | timechart count by sc_status</code>