This website uses cookies. By clicking OK, you consent to the use of cookies. Click Here to learn more about how we use cookies.
OK
Register Now
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 

RSA NetWitness® Platform Discussions

Discussions about the RSA NetWitness Platform.
RALPHCHAPMAN
Beginner
Beginner
‎2014-02-28 02:07 PM

A user with more than 5 logon failures within an hour


Could someone suggest a rule that I could use to create an alert?

0 Likes
Reply
2 Replies
CraigBird2
Beginner
Beginner
‎2014-03-03 04:07 AM

BEC.bmp

Reply
CraigBird2
Beginner
Beginner
In response to CraigBird2
‎2014-03-03 04:09 AM

Sorry just noticed you said hour (not minute), change the time window dropdown to hour. screenshot of the investigation window below:

5fail.bmp

Craig

0 Likes
Reply
© 2020 RSA Security LLC or its affiliates.
All rights reserved.