index="REPLACE_WITH_LOGIN_INDEX" sourcetype="REPLACE_WITH_LOGIN_SOURCETYPE" earliest=-24h latest=now
| stats count AS attempts dc(user) AS accounts count(eval(action="failure")) AS failures count(eval(action="success")) AS successes min(_time) AS first_seen max(_time) AS last_seen BY src
| where accounts>=20 AND failures>successes*10
| convert ctime(first_seen) ctime(last_seen)
| sort - accounts
| head 500