Failed logon attempt group by userName and unique Endpoint involved

# --- Query Metadata ---
# Human-readable name for the query. Will be displayed as the title.
name: Failed logon attempt group by userName and unique Endpoint involved
# MITRE ATT&CK technique IDs
#mitre_ids:

# Description of what the query does and its purpose.
#description:

# The author or team that created the query.
author: CrowdStrike

# The required log sources to run this query successfully in Next-Gen SIEM.
log_sources:
  - Endpoint

# Tags for filtering and categorization.
tags:
  - Hunting

cs_required_modules: 
  - Insight
  
# --- Query Content ---
# The actual CrowdStrike Query Language (CQL) code.
# Using the YAML block scalar `|` allows for multi-line strings.
cql: |
  #event_simpleName = UserLogonFailed
  | groupBy(UserName, function=([count(timestamp, distinct=true, as=uniqueFailedLogons), (count(aid, distinct=true, as=uniqueEP)), collect(fields = [ComputerName, aid], limit =10000)]))
  | default(field = "UserName", value="-", replaceEmpty=true)
  | uniqueFailedLogons >= 5
  | uniqueEP >= 10
  | sort(uniqueEP)

# Explanation of the query.
# Using the YAML block scalar `|` allows for multi-line strings.
# Uses markdown for formatting on the webpage.
#  explanation: |