Slow and Low attack? How to use Windows event logs to alert for the failed attempts less than 5 occurring for every hour?
index=wineventlog EventCode=4625
Might consider using transactions.
index=wineventlog EventCode=4625
| transaction <username field> maxspan=1h
| where eventcount < 5
| table <username> first last eventcount