How to create an alert for 3 consecutive Windows failed logon events?

Question

I´m new in zabbix.

Currently I have this Trigger that monitors Windows Security event 4625(Failed Logon), that it fires an Info envent in Monitoring > Problems.

{DESKTOP-5UOSKC5:eventlog[Security,,,,4625,,skip].logeventid(4625)}=1

My problem is that it genereate an Alert for every Failed Logon.

How I can achieve only one alert for every 3 events in the same machine?

Answer 1

You can count the number of events in a time span. To get an alarm for 3 or more events in a rolling 30 minutes window:

{HOST:eventlog[Security,,,,4625,,skip].count(30m,"4625",regexp)}>=3