Hello team.
I can look for an event to see failed login attempts with;
event where operation = 'ConsoleLogin' and json.rule = $.responseElements.ConsoleLogin != 'Success'
Is there a way to count these (like we see in config with 'as X; count(X) greater than 5').
I want an alert which shows when the number of failed login attempts exceeds 5.
Thank you so much for your time in looking.
