Login Failed attempts Query For WINDOWS

Below is the query that shows login failed attempts for users within the past 24 hours.
-- You can change '24 hours' in the last line.

-- Shows failed login events for a user within the past 24 hours.

SELECT 
datetime(time,'unixepoch','localtime') as 'Time', 
eventid, 
task_message,
json_extract(data,'$.EventData.FailureReason')as FailureReason,
json_extract(data,'$.EventData.TargetUserName') as UserName
FROM sophos_windows_events
WHERE eventid='4625' AND UserName <> '' AND time > STRFTIME('%H','NOW','24 hours');

--Description of Event ID 4625 is "An account failed to log on".

thanks buddy . really appreciate that !

thanks buddy . really appreciate that !