Hi,
Our client is having endpoint and server with XDR, Please let us know if there is a query or report available for User password failed attempt on Windows MAC and Linux systems.
Also is there an option for sending an alert for this to central admin email account. Please let us know if there is an alternative solution for this.
Hi Hemanth,
Thanks for reaching out to the Sophos Community Forum.
I was able to locate a query for Windows devices which may accomplish what you're looking for.
- Live Discover Query - Brute Force Activity
An in-built query for Linux devices already exists: 
For macOS devices, a "failed_login_count" identifier is present, however this only applies to "OpenDirectory". See "account_policy_data" in the following link. Live Discover/Response relies on the open source osquery schema for macOS.
- osquery.io/.../5.3.0
Hi Hemanth,
Thanks for reaching out to the Sophos Community Forum.
I was able to locate a query for Windows devices which may accomplish what you're looking for.
- Live Discover Query - Brute Force Activity
An in-built query for Linux devices already exists:
For macOS devices, a "failed_login_count" identifier is present, however this only applies to "OpenDirectory". See "account_policy_data" in the following link. Live Discover/Response relies on the open source osquery schema for macOS.
- osquery.io/.../5.3.0
