A collection for MSSQL :

• mssql logs parser
• bruteforce detection

Example acquisition for this collection :

1source: wineventlog
2event_channel: Application
3event_ids:
4 - 18456
5event_level: information
6labels:
7 type: eventlog

notes:

• You need to enable failed login logs (which should be on by default)