Dears,

I have an issue where I can find multiple windows login failures events at the same time for the same user.

for example:

I can find 4 login failure events that share same exact data ( ex: src ip addr, dst ip addr, log source, username, Time), except source port as it would be different in each event. 

I guess it's not possible that the user made 4 login attempts/connection within the same second or even microsecond, but I still can't understand what each event means and how could I fix it in order to know how many exact login attempt did the user make. 

also why there are 4 different source port ? 

I also have another question

when I look at the event payload there's a parameter called time generated

it would be something like

TimeGenerated=1622272077

what is the format of this time? is it in microseconds?

------------------------------
Muhammad Lebda
------------------------------

I am wondering if this is a situation where you have a client logging to the network after some time being disconnected and then the logs collected in the meantime are pushed as a bundle. By default QRadar would use the time when the logs arrive to the event collection service for correlation (this is by design). If this is the case then you would probably opt to avoid real-time and use historical correlation schedule to monitor such log sources; using historical correlation enables you to use the Log Source Time from the log for correlation purposes. There's more on difference between different log time stamps in QRadar in this technote and about historical correlation in this documentation article.

------------------------------
Dusan VIDOVIC
------------------------------

Hi, time looks like epoch time

you can easily convert it to human readable time.

google for "epoch time converter"
Original Message:
Sent: Mon November 01, 2021 10:43 AM
From: Dusan VIDOVIC
Subject: Qradar Multiple events at the same exact time

I am wondering if this is a situation where you have a client logging to the network after some time being disconnected and then the logs collected in the meantime are pushed as a bundle. By default QRadar would use the time when the logs arrive to the event collection service for correlation (this is by design). If this is the case then you would probably opt to avoid real-time and use historical correlation schedule to monitor such log sources; using historical correlation enables you to use the Log Source Time from the log for correlation purposes. There's more on difference between different log time stamps in QRadar in this technote and about historical correlation in this documentation article.

------------------------------
Dusan VIDOVIC
------------------------------