Trigger

[virtuallyme]

Hi All, I'm new to Zabbix and I need help with modifying the following trigger to execute only if a user mistypes their password 3 times in 1 minute.

At present I'm getting flooded with events and it's making Windows event log monitoring kind of difficult to put it mildly.

(({xxx:eventlog[Security,,,,4771,,skip].iregexp("0x18")})#0) & {xxx:eventlog[Security,,,,4771,,skip].nodata(3m)}=0

Thanks in advance.

[BDiE8VNy]

Assuming that '0x18' is the indicator for a failed authentication, then how about this:

{xxx:eventlog[Security,,,,4771,,skip].count(1m,"0x18")}>2