County Windows failed-logon volume is huge, and the Authentication data model is healthy and accelerated. What is the efficient default for counting EventCode 4625-style failures?
Select an answer to reveal the explanation.
Short Explanation
When the Authentication model is warmed up, tstats is the express lane for failed-logon counts. Raw EventCode=4625 still works, but it walks the whole county Windows index instead of reading the summary.
Full Explanation
When the Authentication data model is healthy and accelerated, tstats is the efficient default for counting Windows failed-logon style activity such as EventCode 4625 equivalents mapped into CIM. Summaries answer volume questions without walking every raw county Windows event, which matters when failed-logon volume is huge across agencies. Raw index=windows EventCode=4625 still works for deep event inspection, but it should not be the default count path when the model is current and trusted. index=* plus rex for 4625 abandons acceleration and widens the scan across unrelated civic data. transaction of every Windows event before filtering failures is a memory and CPU anti-pattern that fights the volume problem. Exam caveat: tstats only reflects what the model contains—if 4625 is not mapped or acceleration is stale, fix the model rather than silently trusting empty summaries. Operational check: compare a short-window tstats failure count from Authentication to a raw 4625 count on a sample host; if they align, standardize tstats for county-wide failure volume dashboards and reserve raw scans for event-level forensics. Document the revised SPL in the civic SOC runbook so the next on-call analyst inherits the efficient pattern rather than the anti-pattern.