‎2014-02-28
02:07 PM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
A user with more than 5 logon failures within an hour
Could someone suggest a rule that I could use to create an alert?
- Tags:
- Community Thread
- Discussion
- Failure
- Forum Thread
- Login
- NetWitness
- NW
- NWP
- RSA NetWitness
- RSA NetWitness Platform
- Rule
2 Replies
‎2014-03-03
04:07 AM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
‎2014-03-03
04:09 AM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
Sorry just noticed you said hour (not minute), change the time window dropdown to hour. screenshot of the investigation window below:
Craig
