[GH-ISSUE #66] Feature Request: Failed Logons #1977

New issue

Closed

opened 2026-03-14 01:55:38 +03:00 by kerem · 3 comments

kerem commented

2026-03-14 01:55:38 +03:00

Owner

Originally created by @dan578 on GitHub (Aug 25, 2020).
Original GitHub issue: https://github.com/amidaware/tacticalrmm/issues/66

Originally assigned to: @wh1te909, @sadnub on GitHub.

Hi,

I know we can already check the log for event ID's so we can check for failed logon ID's. However it's not really customizable in the sense of 100 failed logon's in 24 hours would trigger the alert. Could this be added?

Thanks for all your work!

Originally created by @dan578 on GitHub (Aug 25, 2020). Original GitHub issue: https://github.com/amidaware/tacticalrmm/issues/66 Originally assigned to: @wh1te909, @sadnub on GitHub. Hi, I know we can already check the log for event ID's so we can check for failed logon ID's. However it's not really customizable in the sense of 100 failed logon's in 24 hours would trigger the alert. Could this be added? Thanks for all your work!

kerem

2026-03-14 01:55:38 +03:00

closed this issue
added the
enhancement
label

kerem commented

2026-03-14 01:55:55 +03:00

Author

Owner

@wh1te909 commented on GitHub (Aug 25, 2020):

hi sorry just trying to understand the new feature, are you asking to be allowed to set a search period less than 24 hours like let's say only search the past 5 minutes of the log?

@wh1te909 commented on GitHub (Aug 25, 2020): hi sorry just trying to understand the new feature, are you asking to be allowed to set a search period less than 24 hours like let's say only search the past 5 minutes of the log?

kerem commented

2026-03-14 01:56:00 +03:00

Author

Owner

@dan578 commented on GitHub (Aug 25, 2020):

Hi, No problem I don't think I explained it well!

We would be looking for something like 500 events in 24 hours of the failed logon type.
(Event 4625) Which would be 500 failed logons.

I don't think its currently possible to specify how many of something should be or shouldn't be in the event logs? Just if it exists or doesn't.

Sorry does that make more sense?

Thanks

@dan578 commented on GitHub (Aug 25, 2020): Hi, No problem I don't think I explained it well! We would be looking for something like 500 events in 24 hours of the failed logon type. (Event 4625) Which would be 500 failed logons. I don't think its currently possible to specify how many of something should be or shouldn't be in the event logs? Just if it exists or doesn't. Sorry does that make more sense? Thanks

kerem commented

2026-03-14 01:56:05 +03:00

Author

Owner

@wh1te909 commented on GitHub (Aug 25, 2020):

perfect yep makes sense now thanks! ok i'll work on this, will be in the next agent release. i'll update this ticket when it's done so you can test

@wh1te909 commented on GitHub (Aug 25, 2020): perfect yep makes sense now thanks! ok i'll work on this, will be in the next agent release. i'll update this ticket when it's done so you can test