Description of the failed login filters illustration
This figure displays the three filters for the Failed Logins action. The three filters are:
-
action_name equals LOGON.
-
returncode doesn't equal 0.
-
time greater than "MM:DD:YYYY HH:MM:SS"