Detection of user who failed logons
This query analyzes login events to identify users with more than five failed login attempts. It filters for login-related events, groups the data by username, endpoint name, failure reason, login type, and associated indicators, then counts the number of failed attempts. The results are sorted in descending order of failed attempts to highlight potentially suspicious activity.
SentinelOne
