#event_simpleName=UserLogonFailed2 event_platform=Win
| SubStatus_hex := format(field=SubStatus, "0x%x")
| $falcon/helper:enrich(field=SubStatus)
| $falcon/helper:enrich(field=LogonType)
| groupBy([aid, ComputerName, UserName, LogonType, SubStatus_hex, SubStatus], function=([count(aid, as=failCount), min(ContextTimeStamp, as=firstLogonAttempt), max(ContextTimeStamp, as=lastLogonAttempt), collect([LocalAddressIP4, aip])]))
| failCount>50
| firstLastDeltaHours:=(lastLogonAttempt-firstLogonAttempt)/60/60 | firstLastDeltaHours:=round("firstLastDeltaHours")
| logonAttemptsPerHour:=(failCount/firstLastDeltaHours) | logonAttemptsPerHour:=round("logonAttemptsPerHour")
| firstLogonAttempt:=formatTime(format="%F %T.%L %Z", field="firstLogonAttempt")
| lastLogonAttempt:=formatTime(format="%F %T.%L %Z", field="lastLogonAttempt")
| sort(failCount, order=desc, limit=20000)