A collection for MSSQL :

• mssql logs parser
• bruteforce detection

Example acquisition for this collection :

source: wineventlog
event_channel: Application
event_ids:
 - 18456
event_level: information
labels:
 type: eventlog

notes:

• You need to enable failed login logs (which should be on by default)