Mar 06 2019
- last edited on
Apr 07 2022
I have created failed login reports showing username, IP address, number of attempts, with date and time. I see under Security \ Common Security Log an item listed as Source Mac Address; is there a way / method this can be added to a report?
Mar 08 2019 12:07 AM
Can you provide what kind of data you are querying. Every table has its own schema and not necessary every record contains all the fields from the schema. That depends on the source that is generating the records.
Mar 09 2019 02:18 AM
If you talk about on-prem AD failed logons the log you need to take is SecurityEvent.
Here is query for retrieving the failed logons (event id 4625) for the last 24 hours.
| where EventID == 4625
| where AccountType == 'User'
| where TimeGenerated > now() - 24hrs
| project TimeGenerated, Account, DomainController=Computer, IpAddress, LogonType, ClientHostName=WorkstationName, Activity, SubStatus