In my previous blog, I explained what window functions are and how we can use them for threat hunting and detection by giving Cloud Account Takeover Attacks as an example and using the prev() function: In this post, I'll explain the sliding_window_counts plugin and provide you with a query for Password Spray attack detection/hunting. According to the documentation, the sliding_window_counts plugin calculates counts and distinct count of values in a sliding window over a lookback period.
