diff --git a/queries/1354829.yaml b/queries/1354829.yaml
new file mode 100644
index 00000000..299acc97
--- /dev/null
+++ b/queries/1354829.yaml
@@ -0,0 +1,3 @@
+query: >
+  message:"sudo: 3 incorrect password attempts" AND tags:"console" AND
+  build_node:*-rax-dfw-*