Is anyone else seeing multiple events logged for the same failed authentication attempt?
When one user fails to authenticate to a server, there are sometimes 5+ events that appear, all within one second of each other. It's sorta making it tough to determine which behaviors are abnormal and deserve IR team focus. It may be something I've configured incorrectly - not gonna lie, I'm still not great at this. lol
Thanks in advance for any advice anyone can offer!