# Failed Logon Attempts (All Users)

#### Objective

Create a dashboard and visualization to monitor failed logon attempts for all users.

#### Steps

1. **Navigate to the Target System**
   * Access the SIEM tool via `http://[Target IP]:5601`.
   * Go to "Dashboard" from the side navigation.
2. **Delete Existing Dashboard**
   * Remove the "SOC-Alerts" dashboard if present.
3. **Create New Dashboard**
   * Click "Create new dashboard" to start from scratch.
4. **Set Up the Visualization**
   * **Set Date Range**: Use the time picker to select "last 15 years" as the date range, then apply it.
   * **Filter Configuration**
     * Use Event ID `4625` to filter failed logon attempts.
   * **Index Pattern**
     * Set `windows*` as the index pattern to use Windows-related logs.
   * **Search Bar Check**
     * Confirm `user.name.keyword` is in the dataset for accurate aggregation.
   * **Select Visualization Type**
     * Choose the "Table" option for the display.
5. **Configure Table Settings**
   * **Rows Settings**
     * Set up rows to display:
       * **Username** - account attempting logon (`user.name.keyword`).
       * **Machine** - reporting host machine (`host.hostname.keyword`).
       * **Count of Events** - metric to show number of attempts.
   * **Metrics**
     * Select "count" to populate the table based on the dataset.
6. **Save the Visualization**
   * Click "Save and return" to add it to the dashboard.

#### Refining the Visualization

1. **Edit the Visualization**
   * Access the previously created visualization and select "Edit lens".
   * **Column Names**
     * Update for clarity as per SOC Manager's suggestion.
   * **Add Logon Type**
     * Include `winlog.logon.type.keyword` field for detailed logon types.
   * **Sort Results**
     * Sort the data within the visualization for better readability.
   * **Exclude Specific Usernames**
     * Filter out usernames like `DESKTOP-DPOESND`, `WIN-OK9BH1BCKSD`, and `WIN-RMMGJA7T9TC`.
   * **Exclude Computer Accounts**
     * Use a KQL query to exclude computers: `NOT user.name: *$ AND winlog.channel.keyword: Security`.
2. **Save Refinements**
   * Finalize and save the visualization with a suitable title.

***

The completed table will now display:

* Usernames, excluding specified computer accounts.
* Machines where failed attempts occurred.
* The count of failed logon attempts over the defined timeframe.