Forum Discussion
OMS Query - Failed Logins
I have created failed login reports showing username, IP address, number of attempts, with date and time. I see under Security \ Common Security Log an item listed as Source Mac Address; is there a way / method this can be added to a report?
2 Replies
If you talk about on-prem AD failed logons the log you need to take is SecurityEvent.
Here is query for retrieving the failed logons (event id 4625) for the last 24 hours.
SecurityEvent
| where EventID == 4625
| where AccountType == 'User'
| where TimeGenerated > now() - 24hrs
| project TimeGenerated, Account, DomainController=Computer, IpAddress, LogonType, ClientHostName=WorkstationName, Activity, SubStatusHi,
Can you provide what kind of data you are querying. Every table has its own schema and not necessary every record contains all the fields from the schema. That depends on the source that is generating the records.
