Description of the query:
Find all failed logons, and return specifically the SrcIP, LogonType, Username, and SrcHostname of the logons. Useful for developing baselines and threat hunting for exposed systems being brute-forced.
Query:
-24h | plat==windows | WEL | event/EVENT/System/EventID is '4625' | event/EVENT/EventData/IpAddress as SrcIP event/EVENT/EventData/LogonType as LogonType event/EVENT/EventData/TargetUserName as Username event/EVENT/EventData/WorkstationName as SrcHostname