GitLab - Brute-force Attempts

Requête originale, sans modification.

let LearningPeriod = 7d; 
let EndLearningTime = now();
let BinTime = 1h; 
let RunTime = 1h; 
let MinThreshold = 3.0; 
let GitLabFailedLogins = (GitLabApp
| where FailedLogin == 1
| parse kind=regex Message with "Failed Login: username=" User "ip=" IpAddress 
| project TimeGenerated, EventTime, Computer, User, HostName, HostIP, IpAddress);
GitLabFailedLogins 
| where EventTime between (ago(LearningPeriod) .. EndLearningTime) 
| summarize FailedLoginsCountInBinTime = count() by User, bin(EventTime, BinTime) 
| summarize AvgOfFailedLoginsInLearning = avg(FailedLoginsCountInBinTime), StdOfFailedLoginsInLearning = stdev(FailedLoginsCountInBinTime) by User 
| extend LearningThreshold = max_of(AvgOfFailedLoginsInLearning, MinThreshold) 
| join kind=innerunique ( GitLabFailedLogins 
| summarize FailedLoginsCountInRunTime = count() by User, IpAddress, EventTime = bin(EventTime, BinTime) ) on User 
| where FailedLoginsCountInRunTime >= LearningThreshold
| project User, IpAddress, EventTime, FailedLoginsCountInRunTime, LearningThreshold