Get an overview of 401 and 403 errors, an increase might be an IoC.
1 |
<code>index=* sourcetype="ms:iis:default" sc_status=401 OR sc_status=403 |table _time, sc_status, sc_substatus, uri_path | timechart count by sc_status</code> |