✄𐘗
text code block:
✄𐘗| tstats `security_content_summariesonly` values(Authentication.user) AS unique_user_names dc(Authentication.user) AS unique_accounts values(Authentication.app) as app count(Authentication.user) as total_failures from datamodel=Authentication.Authentication where Authentication.action="failure" NOT Authentication.src IN ("-","unknown") by Authentication.action Authentication.app Authentication.authentication_method Authentication.dest 
  Authentication.signature Authentication.signature_id Authentication.src sourcetype _time span=5m  
| `drop_dm_object_name("Authentication")`
    ```fill out time buckets for 0-count events during entire search length```
| appendpipe [| timechart limit=0 span=5m count | table _time] | fillnull value=0 unique_accounts
  ``` Create aggregation field & apply to all null events```
| eval counter=src+"__"+sourcetype+"__"+signature_id  | eventstats values(counter) as fnscounter  | eval counter=coalesce(counter,fnscounter) 
  ``` stats version of mvexpand ```
| stats values(app) as app values(unique_user_names) as unique_user_names values(total_failures) as total_failures values(src) as src values(signature_id) as signature_id values(sourcetype) as sourcetype count by counter unique_accounts _time
    ``` remove duplicate time buckets for each unique source```
| sort - _time unique_accounts | dedup _time counter
    ```Find the outliers```
| eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by counter | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 30 and unique_accounts >= upperBound, 1, 0) | replace "::ffff:*" with * in src  | where isOutlier=1  | foreach * 
    [ eval <<FIELD>> = if(<<FIELD>>="null",null(),<<FIELD>>)] 
| table _time, src, action, app, unique_accounts, unique_user_names, total_failures, sourcetype, signature_id, counter | `detect_password_spray_attempts_filter`