Imperva Cyber Community

communities_1.jpg
 View Only

  • 1.  Using "Having" in the DSF Analyzer

    Posted 12-08-2025 15:31

    Does anyone know how to use the "Having" section in this screen?   I am trying to get a report of failed logon attempts by user where the user has more than 10 failed logon attempts.


    #DatabaseActivityMonitoring

    ------------------------------
    Mike Whalen
    Sr. Analyst, Distributed DB Security
    Lincoln Financial Group
    Radnor PA
    ------------------------------


  • 2.  RE: Using "Having" in the DSF Analyzer
    Best Answer

    Posted 12-09-2025 09:23

    use this values   count: { $gt: 10 }  at the "Having" section in screen you get the results of failed logon attempts by user where the user has more than 10 failed logon attempts if all the group section attributes have the same values .



    ------------------------------
    Rev1
    ------------------------------



  • 3.  RE: Using "Having" in the DSF Analyzer

    Posted 12-09-2025 12:16

    Thanks Rev1 ... that worked perfectly.



    ------------------------------
    Mike Whalen
    Sr. Analyst, Distributed DB Security
    Lincoln Financial Group
    Radnor PA
    ------------------------------

    Original Message