Triage queue
// Operations
Password spray from 185.100.200.50 against 24 accounts
A single external address failed authentication against 24 distinct directory accounts inside twelve minutes.
ALT-A61185HighInvestigating
74Elevated
This alert has been escalated. Open the incident to see the full case.
Why this fired
20+ events where eventType is AUTHENTICATION_FAILURE, grouped by sourceIp, within 15 minutes
One source address failing authentication repeatedly inside a short window, consistent with spraying a common password across many accounts.
Triggering event
The exact record that satisfied the rule.
Authentication FailureLow2026-09-04 14:26:53ZWIN-DC01
Pre-authentication failed for jmercier from 185.100.200.50 (status 0x18: bad password)
What else was happening
Other activity for jmercier in the surrounding hour.
| Time | Event | Severity | Host |
|---|---|---|---|
| 2026-09-04 14:17:17Z | Authentication Failure | Low | WIN-DC01 |
| 2026-09-04 14:18:39Z | Authentication Success | Info | WS-FIN-002 |
| 2026-09-04 14:19:18Z | Authentication Success | Info | WS-FIN-007 |
| 2026-09-04 14:20:29Z | Authentication Failure | Low | WIN-DC01 |
| 2026-09-04 14:23:41Z | Authentication Failure | Low | WIN-DC01 |
| 2026-09-04 14:35:11Z | Authentication Success | Info | WS-FIN-008 |
| 2026-09-04 14:49:48Z | Authentication Success | Info | WS-FIN-005 |
| 2026-09-04 15:17:57Z | Authentication Success | Info | WS-FIN-010 |
| 2026-09-04 15:21:45Z | Authentication Success | Info | WS-FIN-009 |
Alert
- Raised
- 7d ago
- Last updated
- 7d ago
- Risk score
- 74
- Source
- WIN-DC01
- Origin
- Lahore, Pakistan
- Detected by
- Correlation rule