Search Query:
index=winevent source="WinEventLog:Security" EventCode="4624
| stats count by user Source_Network_Address
Output utilizing Sankey visualization:
User A 10.20.30.40
Target Count Source Count
- 10.20.30.40 26 User A 26
User B 30
User B 10.20.30.50
Target Count Source Count
- 10.20.30.40 30 User B 10
- 10.20.30.50 10
How do I only identify Users that have connected to more than 1 box? I attempted to use the Where function/argument however I may inputting the syntax incorrectly since it provides no results.
Hi @SecDesh
Can you please try this
UPDATED REPLY
index=winevent source="WinEventLog:Security" EventCode="4624
| stats values(Source_Network_Address) as SAN by user
| eval Total=mvcount(SAN)
| where Total>1
Hi @SecDesh
Can you please try this
UPDATED REPLY
index=winevent source="WinEventLog:Security" EventCode="4624
| stats values(Source_Network_Address) as SAN by user
| eval Total=mvcount(SAN)
| where Total>1
The query you provided does work, however it does not work for the Sankey Diagram visualization, much less any other visualization beyond a statistics table since any other doesn't display the IPs, just users and count. I'm assuming because there's now a third/fourth variable. It also doesn't provide the counts for each connection attempt to the IP. However the information is great and I'll see if I can mess around to perfect it. Any other tidbits or help would be greatly appreciated.
Output:
user SAN Total
User A 10.20.30.40 2
10.20.30.50