Active response to disable multiple failed login - Windows

[commodore]

Hello all,

How can I create active response to disable a user on windows after multiple failed logins?

Thank you

[Ifeanyi Onyia Odike]

Hi @commodore,

We currently do not have an out-of-the-box script for this active response.

The development of this script is in progress: https://github.com/wazuh/wazuh/issues/15408

However, you might find the guideline for developing a custom active response helpful: https://documentation.wazuh.com/current/user-manual/capabilities/active-response/custom-active-response-scripts.html#custom-active-response-scripts

Regards,