RQL AWS Failed Login attempts > 5

[MPestell]

Hello team.

I can look for an event to see failed login attempts with;

event where operation = 'ConsoleLogin' and json.rule = $.responseElements.ConsoleLogin != 'Success'

Is there a way to count these (like we see in config with 'as X; count(X) greater than 5').

I want an alert which shows when the number of failed login attempts exceeds 5.

Thank you so much for your time in looking.

[AKing9]

Greetings MPestell,

I hope that this note finds you well! I know that it has been a while since you had posted this question but I wanted to see if you still potentially needed any help. Thank you for your time and I hope that you have a good remainder of your day.

Kind Regards,

J. Avery King

[NNawaz]

Greetings,

Unfortunately, count(X) is not supported with Event RQL yet. Customers can open up a feature request ticket on AHA. 

RQL example

RQL reference guide

AHA link


Best regards,

Naveed Nawaz