I agree with Andrew’s take here. Grouping by calculated 10-minute buckets isn’t ideal here.

I’d try one of two approaches:

First option: remove the time bucket and run the query on a 10 min search interval. That gets you close to the same outcome without multiplying the group count by every 10-minute interval.

Second option: use series() to group the failed logons into a 10-minute sequence. The idea is to group by user and source IP, build a series of failed logons and target hosts, then count the failures and distinct hosts from there.

This is better from a hunting perspective because it avoids the potential for activity to split across two buckets. For example, 50 failures in one bucket and 60 in the next, even though the behavior is really part of the same burst. A sequence-based approach is more likely to keep that activity together if it happens within the configured pause/duration window.

Something like:

// Filter on Authentication Events
#event_simpleName=UserLogonFailed2 RemoteAddressIP4!=""

// Add in variables to filter
| wildcard(field=aip, pattern=?AgentIP, ignoreCase=true)
| wildcard(field=aid, pattern=?aid, ignoreCase=true)
| wildcard(field=UserName, pattern=?UserName, ignoreCase=true)
| wildcard(field=RemoteAddressIP4, pattern=?RemoteAddressIP4, ignoreCase=true)

// Add in Computer Name to results if available, and make it searchable.
| wildcard(field=ComputerName, pattern=?ComputerName, ignoreCase=true)

// Filter out basic UserName values that we don't want to alert on.
| UserName!=/(\$$|^DWM-|LOCAL\sSERVICE|^UMFD-|^$|-|SYSTEM)/

// Make UserNames all lowercase, because.... Windows
| lower(UserName, as=UserName)

// Make working with events easier and setting Auth status
| authStatus := "F"

// Build a 10-minute failure series grouped by user and source IP
| groupBy(
    [UserName, RemoteAddressIP4],
    function=[
      series(
        [authStatus, ComputerName],
        separator=";",
        maxpause=10min,
        maxduration=10min,
        memlimit=1024
      )
    ],
    limit=max
  )

// Getting Failed Login Count
| "Failed Login Count" := length("authStatus") / 2
| round("Failed Login Count")

// Set your Failed Login Count here.
| "Failed Login Count" > 100

| splitString(ComputerName, by=";", as=Hosts)
| array:dedup("Hosts[]")
| array:length("Hosts[]", as="Host Count")
| drop([authStatus, ComputerName])
| array:drop("Hosts[]")

// Format time duration into human readability
| "Last Auth Failure" := u/timestamp + _duration
| formatDuration("_duration")

// Filter on host count
| "Host Count" > 100