BUILD, Rules, drag the failedauthentication event, specify the event count and the sliding time frame. Use the tiny icon next to the time frame to bring up the advanced options editor and drag the sourcemachine field. You can leave the time window drop down as the default of 5 minutes. You can refer to the new evaluation guide under the documentation section of the solarwinds website for an example of creating custom rules
↧