Feature Request: Failed Logons about tacticalrmm

[wh1te909]

hi sorry just trying to understand the new feature, are you asking to be allowed to set a search period less than 24 hours like let's say only search the past 5 minutes of the log?

[dan578]

Hi, No problem I don't think I explained it well!

We would be looking for something like 500 events in 24 hours of the failed logon type.
(Event 4625) Which would be 500 failed logons.

I don't think its currently possible to specify how many of something should be or shouldn't be in the event logs? Just if it exists or doesn't.

Sorry does that make more sense?

Thanks

[wh1te909]

perfect yep makes sense now thanks! ok i'll work on this, will be in the next agent release. i'll update this ticket when it's done so you can test