metrics-*


[Elastic Agent] CPU Usage

Question: data_stream.dataset : "elastic_agent.elastic_agent"

if (params.cpu_total > 0) {
  return params.cpu_total / params._interval
}

[Elastic Agent] CPU Usage


[Elastic Agent] Memory usage

Question: data_stream.dataset : "elastic_agent.elastic_agent"

[Elastic Agent] Memory usage


[Elastic Agent] Memory usage (copy)

Question: data_stream.dataset : "elastic_agent.elastic_agent"

Question: data_stream.dataset : "elastic_agent.elastic_agent"

if (params.memory_limit  < 999999999999999999L) {
 return params.memory_limit;
}

[Elastic Agent] Memory usage (copy)


[Elastic Agent] Open Handles

Question: data_stream.dataset : "elastic_agent.elastic_agent"

[Elastic Agent] Open Handles


Total events processed by the output (including retries). (From beat.stats.libbeat.output.events.total)

Question: data_stream.dataset : "elastic_agent.*"

[Elastic Agent] Total events rate /s


Events acknowledged by the output (includes events dropped by the output). (From beat.stats.libbeat.output.events.acked)

Question: data_stream.dataset : "elastic_agent.*"

[Elastic Agent] Events acknowledged rate /s


Errors in writing the response from the output. (From beat.stats.libbeat.output.write.errors)

Question: data_stream.dataset : "elastic_agent.*"

[Elastic Agent] Output write errors


Bytes written to the output (consists of size of network headers and compressed payload)

Question: data_stream.dataset : "elastic_agent.*"

[Elastic Agent] Output write throughput


[Elastic Agent] CGroup CPU Usage

Question: data_stream.dataset : "elastic_agent.elastic_agent"

      if (params.deltaUsageDerivNormalizedValue > 0 && params.periodsDerivNormalizedValue >0  && params.quota > 0) {
        // if throttling is configured
        double  factor = params.deltaUsageDerivNormalizedValue / (params.periodsDerivNormalizedValue * params.quota * 1000);

        return factor * 100;
      }

      return null;

[Elastic Agent] CGroup CPU Usage


Elastic Agent metrics dashboard

Host name

[Elastic Agent] CGroup Memory usage

[Elastic Agent] Errors in writing the response from the output

[Elastic Agent] Agent metrics


Navigation

Navigation


*:logstash-*


Connections - Logs


Connections - Source - Sum of Total Bytes ( Tile Map)


Connections - Source - Sum of Total Bytes


logs-*


Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

Logged on Administrators [Windows System Security]


Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

Admin Logons Simple [Windows System Security]


Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

Administrator Users [Windows System Security]


Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

User Logon Dashboard [Windows System Security]

## **Logon Information Dashboard**


Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

User Logons [Windows System Security]


Question: (data_stream.dataset:windows.application OR data_stream.dataset:windows.forwarded OR data_stream.dataset:windows.powershell OR data_stream.dataset:windows.powershell_operational OR data_stream.dataset:windows.security OR data_stream.dataset:windows.sysmon_operational OR data_stream.dataset:windows.system OR data_stream.dataset:system.application OR data_stream.dataset:system.security OR data_stream.dataset:system.system)

Dashboard links  - Simple [Windows System Security]

[Windows Overview](#/dashboard/system-Windows-Dashboard) | [User Logon Information](#/dashboard/system-bae11b00-9bfc-11ea-87e4-49f31ec44891) |  [Logon Failed and Account Lockout](#/dashboard/system-d401ef40-a7d5-11e9-a422-d144027429da) | [User Management Events](#/dashboard/system-71f720f0-ff18-11e9-8405-516218e3d268) | [Group Management Events](#/dashboard/system-bb858830-f412-11e9-8405-516218e3d268)


Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

Logons Simple [Windows System Security]

Logons Simple [Windows System Security]


Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

Logon Events in Time - Simple [Windows System Security]

Question: event.code: "4624"

Question: event.code: "4672"

Count


Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

Logon Types  [Windows System Security]

Logon Types  [Windows System Security]


Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

Logon Details [Windows System Security]


Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

Logon Sources [Windows System Security]

Logon Sources [Windows System Security]


Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

Remote Interactive Connections and Disconnections [Windows System Security]


Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

Logon with Explicit Credentials [Windows System Security]


Question: Microsoft-Windows-Security-Auditing

Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

User Logouts [Windows System Security]


User logon activity dashboard with TSVB metrics.

Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

Sesiones Usuarios Admin

Usuarios Adm

Network Logon Details

Logon Events Timeline

Logon Types

RDP Reconnections and Desconnections

Logout Details

[System Windows Security] User Logons - Simple Metrics


Question: system.auth.useradd:*

useradd logs [Logs System]


New users [Logs System]

Question: data_stream.dataset : "system.auth"

New users


New users over time [Logs System]

New users over time


New users by shell [Logs System]

Question: data_stream.dataset : "system.auth"

New users by shell


New users by home directory [Logs System]

New users by home directory


Question: system.auth.groupadd:*

groupadd logs [Logs System]


New groups [Logs System]

New groups


New groups over time [Logs System]

New groups over time


Dashboards [Logs System]

[Syslog](#/dashboard/system-Logs-syslog-dashboard) | [Sudo commands](#/dashboard/system-277876d0-fa2c-11e6-bbd3-29c986c96e5a) | [SSH logins](#/dashboard/system-5517a150-f9ce-11e6-8115-a7c18106d86a) | [New users and groups](#/dashboard/system-0d3f2380-fa78-11e6-ae9b-81e5311e8cab)

Dashboards [Logs System]


New users and groups dashboard for the System integration in Logs

[Logs System] New users and groups


Question: system.auth.sudo:*

Sudo commands [Logs System]


Sudo commands by user [Logs System]

Sudo commands by user


Question: system.auth.sudo.error:*

Sudo errors [Logs System]

Sudo errors


Top sudo commands [Logs System]

Question: data_stream.dataset : "system.auth"

Top sudo commands


Sudo commands dashboard from the Logs System integration

[Logs System] Sudo commands


Question: system.auth.ssh.event:Accepted

Successful SSH logins [Logs System]

Successful SSH logins


SSH login attempts [Logs System]

SSH login attempts


Question: system.auth.ssh.event:Failed OR system.auth.ssh.event:Invalid

SSH users of failed login attempts [Logs System]

SSH users of failed login attempts


Question: system.auth.ssh.event:Failed OR system.auth.ssh.event:Invalid

SSH failed login attempts source locations [Logs System]


Question: data_stream.dataset:system.auth AND system.auth.ssh.event:*

SSH login attempts [Logs System]


SSH dashboard for the System integration in Logs

[Logs System] SSH login attempts


Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

User  Management Events - Description [Windows System Security]

# **User Management Events**

#### This dashboard shows information about User Management Events collected by winlogbeat


Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

Users Created - Table [Windows System Security]


Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

Users Enabled - Table [Windows System Security]


Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

Users Disabled - Table [Windows System Security]


Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

Users Deleted - Table [Windows System Security]


Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

Users Password Changes - Table [Windows System Security]


Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

Unlocked Users - Table [Windows System Security]


Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

Users Changes  Table [Windows System Security]


Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

Users Locked Out - Table [Windows System Security]


Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

User management Details - Search [Windows System Security]


Users Disabled - TSVB  Metric [Windows System Security]

Question: ((data_stream.dataset:windows.security OR data_stream.dataset:system.security) AND event.code: "4725")


Users Enabled - TSVB Metric [Windows System Security]

Question: event.code: "4722"


Users Deleted - TSVB  Metric [Windows System Security]

Question: event.code: "4726"


Users Created - TSVB  Metric [Windows System Security]

Question: event.code: "4720"


Users Unlocks - TSVB Metric [Windows System Security]

Question: event.code: "4767"


Users Password Changes - TSVB Metric [Windows System Security]

Question: event.code: "4723"  OR event.code: "4724"


Users locked Out - TSVB Metric [Windows System Security]

Question: ((data_stream.dataset:windows.security OR data_stream.dataset:system.security) AND event.code: "4740")


Users Changes TS VB Metric [Windows System Security]

Question: event.code: "4738"


Users Renamed TSVB Metric [Windows System Security]

Question: event.code: "4781"


Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

Users Renamed - Table [Windows System Security]


Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

Dashboard links  [Windows System Security]


Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

User Management Actions [Windows System Security]


Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

Target Users [Windows System Security]

Target Users [Windows System Security]


Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

User Event Actions - Table [Windows System Security]


Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

User Management Events - Affected Users vs Actions - Heatmap [Windows System Security]


Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

Event Distribution in time [Windows System Security]

Count


User management activity.

Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

Created Users [Windows System Security]

Enabled Users [Windows System Security]

Disabled Users [Windows System Security]

Deleted Users [Windows System Security]

Passwords Changes [Windows System Security]

Unlocked Users [Windows System Security]

Users Changes [Windows System Security]

Locked-out Users [Windows System Security]

Actions performed over Users [Windows System Security]

[System Windows Security] User Management Events


Network Traffic (Packets) [Metrics System]

Question: -system.network.name:l*

params.rate != null && params.rate > 0 ? params.rate * -1 : null

Mericbeat: Network Traffic (Packets)


System Load [Metrics System]

Question: data_stream.dataset : "system.load"

System Load [Metrics System]


Network Traffic (Bytes) [Metrics System]

Question: -system.network.name:l*

Mericbeat: Network Traffic (Bytes)


Memory Usage [Metrics System]

Question: data_stream.dataset : "system.memory"

params.actual != null && params.used != null ? params.used - params.actual : null

Memory Usage [Metrics System]


Top Processes By CPU [Metrics System]

Question: data_stream.dataset : "system.process"

Top Processes By CPU [Metrics System]


Processes By Memory [Metrics System]

Question: data_stream.dataset : "system.process"

Processes By Memory [Metrics System]


CPU Usage [Metrics System]

Question: data_stream.dataset : "system.cpu"

CPU Usage [Metrics System]


Disk IO (Bytes) [Metrics System]

Question: data_stream.dataset : "system.diskio"

Disk IO (Bytes) [Metrics System]


Load Gauge [Metrics System]

Question: data_stream.dataset : "system.load"

Load Gauge [Metrics System]


CPU Usage Gauge [Metrics System]

Question: data_stream.dataset : "system.cpu"

CPU Usage Gauge [Metrics System]


Memory Usage Gauge [Metrics System]

Question: data_stream.dataset : "system.memory"

Memory Usage Gauge [Metrics System]


Inbound Traffic [Metrics System]

Question: -system.network.name:l*

Inbound Traffic [Metrics System]


Outbound Traffic [Metrics System]

Question: -system.network.name:l*

Outbound Traffic [Metrics System]


Disk Usage [Metrics System]

Question: -system.filesystem.mount_point:\/run* AND -system.filesystem.mount_point:\/sys* AND -system.filesystem.mount_point:\/dev* AND -system.filesystem.mount_point:\/proc* AND -system.filesystem.mount_point:\/var* AND -system.filesystem.mount_point:\/boot

Disk Usage [Metrics System]


System Navigation [Metrics System]

[System Overview](#/dashboard/system-Metrics-system-overview)  | [Host Overview](#/dashboard/system-79ffd6e0-faa0-11e6-947f-177f697178b8)

System Navigation [Metrics System]


Swap usage [Metrics System]

Question: data_stream.dataset : "system.memory"

Swap usage [Metrics System]


Memory usage vs total [Metrics System]

Question: data_stream.dataset : "system.memory"

Memory usage vs total


Disk Used [Metrics System]

Question: data_stream.dataset : "system.fsstat"

Disk used [Metrics System]


Packetloss [Metrics System]

Question: data_stream.dataset : "system.network"

Packetloss [Metrics System]


Interfaces by Incoming traffic [Metrics System]

Question: data_stream.dataset : "system.network"


Interfaces by Outgoing traffic [Metrics System]

Question: data_stream.dataset : "system.network"


Number of processes [Metrics System]

Question: data_stream.dataset : "system.process"

Number of processes


Tip [Metrics System]

**TIP:** To select another host, go to the [System Overview](#/dashboard/system-Metrics-system-overview) dashboard and double-click a host name.

Tip [Metrics System]


Overview of host metrics

[Metrics System] Host overview


Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

Users Created - Simple Metric [Windows System Security]


Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

Users Enabled - Simple Metric [Windows System Security]


Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

Users Deleted - Simple Metric [Windows System Security]


Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

Users Disabled - Simple Metric [Windows System Security]


Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

Users Password Reset / Changes [Windows System Security]


Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

Users Unlocks - Simple Metric [Windows System Security]


Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

Unlocked Users - Simple Metric [Windows System Security]


Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

Users Changes - Simple Metric [Windows System Security]


Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

Users Renamed - Simple Metric [Windows System Security]


User management activity with TSVB metrics.

Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

Created Users [Windows System Security]

Enabled Users [Windows System Security]

Disabled Users [Windows System Security]

Deleted Users [Windows System Security]

Passwords Changes [Windows System Security]

Unlocked Users [Windows System Security]

Users Changes [Windows System Security]

Locked-out Users [Windows System Security]

Actions performed over Users [Windows System Security]

[System Windows Security] User Management Events - Simple Metric


Syslog logs [Logs System]


Syslog events by hostname [Logs System]

Syslog events by hostname


Syslog hostnames and processes [Logs System]

Syslog hostnames and processes


Syslog dashboard from the Logs System integration

[Logs System] Syslog dashboard


Number of hosts [Metrics System]

Number of hosts [Metrics System]


Top Hosts By Memory (Realtime) [Metrics System]

Question: data_stream.dataset : "system.memory"


Top Hosts By CPU (Realtime) [Metrics System]

Question: data_stream.dataset : "system.cpu"


Hosts histogram by CPU usage [Metrics System]

Question: data_stream.dataset : "system.cpu"


Overview of system metrics

[Metrics System] Overview


Question: (data_stream.dataset:windows.application OR data_stream.dataset:windows.forwarded OR data_stream.dataset:windows.powershell OR data_stream.dataset:windows.powershell_operational OR data_stream.dataset:windows.security OR data_stream.dataset:windows.sysmon_operational OR data_stream.dataset:windows.system OR data_stream.dataset:system.application OR data_stream.dataset:system.security OR data_stream.dataset:system.system)

Number of Events Over Time By Channel [Windows Overview]

Count


Question: (data_stream.dataset:windows.application OR data_stream.dataset:windows.forwarded OR data_stream.dataset:windows.powershell OR data_stream.dataset:windows.powershell_operational OR data_stream.dataset:windows.security OR data_stream.dataset:windows.sysmon_operational OR data_stream.dataset:windows.system OR data_stream.dataset:system.application OR data_stream.dataset:system.security OR data_stream.dataset:system.system)

Number of Events [Windows Overview]


Question: (data_stream.dataset:windows.application OR data_stream.dataset:windows.forwarded OR data_stream.dataset:windows.powershell OR data_stream.dataset:windows.powershell_operational OR data_stream.dataset:windows.security OR data_stream.dataset:windows.sysmon_operational OR data_stream.dataset:windows.system OR data_stream.dataset:system.application OR data_stream.dataset:system.security OR data_stream.dataset:system.system)

Top Event IDs [Windows Overview]

Top Event IDs [Windows Overview]


Question: (data_stream.dataset:windows.application OR data_stream.dataset:windows.forwarded OR data_stream.dataset:windows.powershell OR data_stream.dataset:windows.powershell_operational OR data_stream.dataset:windows.security OR data_stream.dataset:windows.sysmon_operational OR data_stream.dataset:windows.system OR data_stream.dataset:system.application OR data_stream.dataset:system.security OR data_stream.dataset:system.system)

Event Levels [Windows Overview]

Event Levels [Windows Overview]


Question: (data_stream.dataset:windows.application OR data_stream.dataset:windows.forwarded OR data_stream.dataset:windows.powershell OR data_stream.dataset:windows.powershell_operational OR data_stream.dataset:windows.security OR data_stream.dataset:windows.sysmon_operational OR data_stream.dataset:windows.system OR data_stream.dataset:system.application OR data_stream.dataset:system.security OR data_stream.dataset:system.system)

Sources (Provider Names) [Windows Overview]


Overview of all Windows Event Logs.

Question: (data_stream.dataset:windows.application OR data_stream.dataset:system.application OR data_stream.dataset:windows.forwarded OR data_stream.dataset:windows.powershell OR data_stream.dataset:windows.powershell_operational OR data_stream.dataset:windows.security OR data_stream.dataset:system.security OR data_stream.dataset:windows.sysmon_operational OR data_stream.dataset:windows.system OR  data_stream.dataset:system.system)

[System] Windows Overview


Administrator Logons [Windows System Security]

Question: ((data_stream.dataset:windows.security OR data_stream.dataset:system.security) AND event.code: "4672")


User Logons [Windows System Security]

Question: ((data_stream.dataset:windows.security OR data_stream.dataset:system.security) AND event.code: "4624")

User Logons [Windows System Security]


Logon Events Timeline [Windows System Security]

Question: event.code: "4672" or event.code: "4624"

Question: event.code: "4672"

Question: event.code: "4624"


User logon activity dashboard.

Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

Admin Users Sessions

Administrators Logged On

Logon Details

Logon Events Timeline

Logon Types

RDP Reconnections and Desconnections

Logout Details

[System Windows Security] User Logons


Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

Group Management Events - Description [Windows System Security]

# **Group Management Events**

#### This dashboard shows information about Group Management Events collected by winlogbeat


Users Added - Metric [Windows System Security]

Question: event.code:4732 OR event.code:4728 OR event.code:4756  OR event.code:4751  OR event.code:4761  OR event.code:4746  OR event.code:4785 OR event.code:4787


Groups Deleted  TSVB Metric [Windows System Security]

Question: event.code:4734 OR event.code:4730 OR event.code:4758 OR event.code:4753  OR event.code:4763  OR event.code:4748  OR event.code:4789  OR event.code:4792


Groups Created  TSVB Metric [Windows System Security]

Question: event.code:4731 OR event.code:4727 OR event.code:"4754" OR event.code:"4749" OR event.code:"4759"  OR event.code:"4744"  OR event.code:"4783"  OR event.code:"4790"


Groups Changed TSVB Metric [Windows System Security]

Question: event.code:4735 OR event.code:4737 OR event.code:"4755" OR event.code:"4764"  OR event.code:"4750" OR event.code:"4760" OR event.code:"4745" OR event.code:"4784" OR event.code:"4791"


Users Removed - TSVB Metric [Windows System Security]

Question: event.code:4733 OR  event.code:4729 OR event.code:4788 OR event.code:4786 OR event.code:4752 OR event.code:4762 OR event.code:4747


Groups Enumeration - TSVB  Metric [Windows System Security]


Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

Groups Created - Table [Windows System Security]


Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

Group Changes - Table [Windows System Security]


Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

Groups Deleted - Table [Windows System Security]


Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

Users Added - Table [Windows System Security]


Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

Users Removed from Group - Table [Windows System Security]


Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

Group Enumeration - Table [Windows System Security]


Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

Group Management Details - Search View [Windows System Security]


Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

Group Management Events - Event Actions [Windows System Security]


Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

Group Management Events - Target Groups - Tag Cloud  [Windows System Security]


Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

Group Management Events - Event Actions - Table [Windows System Security]


Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

Group Management Events - Groups vs Actions - Heatmap [Windows System Security]


Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

Group Management Action Distribution over Time [Windows System Security]

Count


Group management activity.

Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

Group Creation Summary [Windows System Security]

Group Changes Summary [Windows System Security]

Group Deletion Summary [Windows System Security]

Users Added to Group  Summary [Windows System Security]

Users Removed From Group Summary [Windows System Security]

Logon Details  [Windows System Security]

Group Management Operations Details [Windows System Security]

[System Windows Security] Group Management Events


Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

Failed Logon and Account Lockout [Windows System Security]

### **Failed Logons and Account Lockouts**


Question: Microsoft-Windows-Security-Auditing

Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

Logon Successful vs Failed [Windows System Security]

Question: event.code: 4624

Question: event.code: 4625


Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

Blocked Accounts Tag [Windows System Security]


Question: Microsoft-Windows-Security-Auditing

Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

Logon Successful - Logon Failed Timeline [Windows System Security]

Question: event.code: 4624

Question: event.code: 4625

Count


Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

Logon Failed Acconts [Windows System Security]


Question: Microsoft-Windows-Security-Auditing

Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

Failed Logon HeatMap [Windows System Security]


Question: Microsoft-Windows-Security-Auditing

Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

3. Login Failed Details


Question: Microsoft-Windows-Security-Auditing

Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

Logon Failed Source IP [Windows System Security]


Question: Microsoft-Windows-Security-Auditing

Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

Logon Failed Table [Windows System Security]


Failed Logons TSVB  [Windows System Security]

Question: ((data_stream.dataset:windows.security OR data_stream.dataset:system.security) AND event.code: "4625")


Blocked Accounts TSVB [Windows System Security]

Question: event.code: "4740"


Failed and blocked accounts with TSVB metrics.

Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

Login Successful vs Failed

Blocked Acoounts

Logon Successful and Failed  Over time

Logon Failed  (Time Mosaic View)

Logon Failed and Account Lockouts

Logon Failed Source IPs

Failed Logins Table

[System Windows Security] Failed and Blocked Accounts


Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

Blocked Accounts  [Windows System Security]


Question: Microsoft-Windows-Security-Auditing

Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

Failed Logons  [Windows System Security]


Failed and blocked accounts.

Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

Login Successful vs Failed

Blocked Acoounts

Logon Successful and Failed  Over time

Logon Failed  (Time Mosaic View)

Logon Failed and Account Lockouts

Logon Failed Source IPs

Failed Logins Table

[System Windows Security] Failed and Blocked Accounts - Simple Metrics