Skip to content

Instantly share code, notes, and snippets.

@weirded

weirded/gist:0ca554d039d4451702ba

Created January 9, 2015 01:27
Show Gist options
  • Save weirded/0ca554d039d4451702ba to your computer and use it in GitHub Desktop.
Save weirded/0ca554d039d4451702ba to your computer and use it in GitHub Desktop.
Download ZIP
Query 3
Raw
gistfile1.txt
error
| parse “ip=*, errorcode=*“ as ip, errorcode
| where errorcode=”failed_login”
| lookup ip from /my/whitelisted_ips on ip=ip
| if( isNull(ip), "unsafe", "safe") as ip_status
| where ip_status="unsafe"
| count by ip
| top 10 newip, ip by _count
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment