ELK KQL

event.code:4625 and source.ip: "10.*"

KQL search in Kibana that filters failed logons (4625) from internal sources, to hunt for sprays and internal brute force.

Run it in Kibana Discover when you have Security logs in Elastic (Winlogbeat) and want to filter 4625s: the KQL (Kibana Query Language) filters by fields with simple syntax — event.code:4625 and source.ip with a wildcard. The internal source filter (10.*) separates internet noise from signal: a failure from an internal IP is an internal spray or a compromised host testing credentials — much more interesting than external brute force. It's the base search for authentication hunting in the Elastic stack, and the same KQL is used in dashboards and detection rules.

Don't use it without the correct mapping: the event field is event.code (from ECS) and the source is source.ip — if your Windows integration doesn't map to ECS, the fields don't exist and the search returns empty. KQL filters on the index, but performance depends on the time range: without bounding, Kibana searches the entire datastream. And watch out: the internal IP filter (10.*) assumes you know your ranges — in networks with non-standard private ranges (172.x, 192.168.x), expand the pattern or use the ECS network field.