Help required on two reports

[RSAAdmin]

Hi Guys, Can anyone help/guide me in creating the below two reports which are required for regular monitoring pusposes in our SOC. have struggled a log but could not achieve it as well. Even the alerts would be helpful. a) Simultaneous Logons – Same IDs logged on from multiple IP's. b) For the "U" failed logons multiple times (T) , successful logon attempts by the same users as well on the server "Y". (U= user) (T= number of time failed login detected) , (Y = hostname/servername) Thanks in advance Shakti P. Sharma

[SandraCarielli]

The blog has a series of articles that guides you through creating an alert when the same user attempts to log in from multiple IPs in a four hour period. The first article is: [[page no longer exists]]