✄𐘗
text code block:
✄𐘗from logs-openai_chatgpt_enterprise.auth_log-*
| where
    data_stream.dataset == "openai_chatgpt_enterprise.auth_log" and
    event.action == "login_failed" and
    user.email is not null
| stats
    Esql.event_count = count(*),
    Esql.source_ip_values = values(source.ip),
    Esql.source_geo_country_iso_code_values = values(source.geo.country_iso_code),
    Esql.user_agent_original_values = values(user_agent.original),
    Esql.timestamp_first_seen = min(@timestamp),
    Esql.timestamp_last_seen = max(@timestamp)
  by user.email
| where Esql.event_count >= 10
| keep user.email, Esql.*