topic Show results only when EventCodes occur in a specific sequence in Getting Data In

Show results only when EventCodes occur in a specific sequence

wgawhh5hbnht — Thu, 22 Aug 2019 21:22:50 GMT

I'm attempting to find events when EventCodes occur in 1, 3, 13, then 4689. (Detection of psexec via windows logs). Here is what I've come up with:

index=windows (EventCode=1 OR EventCode=3 OR EventCode=13 OR EventCode=4689)
 | streamstats count(eval(EventCode="1" OR EventCode="3" OR EventCode="13" OR EventCode=4689)) AS sessionID BY host
 | transaction host startswith=1 endswith=4689

The problem is the search takes forever to complete and either we don't have any psexec running in the environment or the search isn't correct. Can someone take a look at the logic to determine if I'm on the right path, if this returns any results, & if there is a better way to search for this? Thank you in advance!

Re: Show results only when EventCodes occur in a specific sequence

Sukisen1981 — Fri, 23 Aug 2019 06:18:00 GMT

if you remove everything after the first pipe , is the search executing for just index=windows (EventCode=1 OR EventCode=3 OR EventCode=13 OR EventCode=4689) ?
if that is taking too long , can you try these 2 options?
index=windows |fields EventCode|where (EventCode=1 OR EventCode=3 OR EventCode=13 OR EventCode=4689)
OR
index=windows EventCode=|where (EventCode=1 OR EventCode=3 OR EventCode=13 OR EventCode=4689)

does it make a difference?

Re: Show results only when EventCodes occur in a specific sequence

wgawhh5hbnht — Fri, 23 Aug 2019 13:18:40 GMT

The portion that takes a long time is
| transaction host startswith=1 endswith=4689

Re: Show results only when EventCodes occur in a specific sequence

Sukisen1981 — Fri, 23 Aug 2019 18:51:19 GMT

hi @wgawhh5hbnht
can you post a sample event? your command looks ok I am reasonably sure the event structure is different from what I am visualising atm.
PS - One tongue twister of a username 🙂 🙂