| tstats summariesonly=true count AS failures dc(Authentication.user) AS accounts values(Authentication.app) AS apps FROM datamodel=Authentication WHERE Authentication.action="failure" earliest="10/09/2026:00:00:00" BY Authentication.src _time span=1h
| rename Authentication.src AS src
| search NOT src IN ("REPLACE_WITH_CORPORATE_EGRESS_IP")
| where accounts >= 10
| sort 0 - accounts