---
title: Analyze Login Attempts for e-PHI
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: Docs > Log Management > Logs Guides > Analyze Login Attempts for e-PHI
---

# Analyze Login Attempts for e-PHI

## Use case{% #use-case %}

Notebook Analysis features allows you to bring in log data to analyze login attempts and audit access to electronic protected health information (e-PHI). To start monitoring and identifying failed login attempts, use Notebook's flexible querying and visualization options by following these steps.

## Setup{% #setup %}

This guide assumes that you are:

- Submitting logs to Datadog for a similar use case.
- Able to [create a notebook](https://docs.datadoghq.com/notebooks/#creating-a-notebook) and add cells.

### 1. Bring in your data source

To get started, bring in the logs from the service(s) you want to analyze.

1. [Create a new notebook](https://docs.datadoghq.com/notebooks/#creating-a-notebook).
1. Select **Logs** as your data source.

### 2. Query for failed logins

To search for failed login attempts, which might indicate unauthorized attempts to access e-PHI, set up your logs query to filter for these events. An example query might include filtering by an event outcome code that signifies failure.

{% image
   source="https://datadog-docs.imgix.net/images/logs/guide/log_analysis_use_cases/query_failed_logs.8409c14b3e01e1d53194ad23f8722dd2.png?auto=format"
   alt="Example workspace query to find failed login attempts" /%}

You can add any additional filters, facets, or attributes to narrow your search based on your requirements and what is available in your logs.

### 3. Count failed logins by user ID

To analyze the data further, you can count the number of failed login attempts by user ID and sort the results. This is helpful for identifying users with repeated failed login attempts, which may require further investigation.

1. Add an [Analysis cell](https://docs.datadoghq.com/notebooks/advanced_analysis/#analysis-cell) to your notebook.
1. Run a SQL query.
   ```
   SELECT * FROM failed_logins
   ```

   {% image
      source="https://datadog-docs.imgix.net/images/logs/guide/log_analysis_use_cases/analyze_failed_login_count.5f8e90159811a2e43cdff3e2ff9d9032.png?auto=format"
      alt="Analysis cell with query to count the number of failed logins" /%}

### 4. Visualize failed logins over time

To get a clearer picture of when failed logins are occurring, you can create a timeline or Timeseries visualization.

1. Add a [Visualization cell](https://docs.datadoghq.com/notebooks/advanced_analysis/#visualizing-transformed-data).
1. Choose Timeseries from the "Visualize as" dropdown.
1. Configure the graph to display the number of failed login attempts over time, using your query results as the data source.

## Further reading{% #further-reading %}

- [Learn more about Notebooks Analysis features](https://docs.datadoghq.com/notebooks/advanced_analysis/)