How do i find whether the failed login is happened from user login or application or service login is creating these failed attempts ?
Whether logon type gives correct info or any thing can be added ?
For Windows, Use reference id's to authentication failures.
Windows Security Log Event ID 4625 - An account failed to log on
Windows Security Log Event ID 4776 - The domain controller attempted to validate the credentials for an account
For other devices, Track Event.Outcome='failure'
Retrieving data ...