Knowledge Management

Rule to detect 'windows audit log cleared'

Path Finder

here is the start of my search but having issues figuring out the best way to capture the information i need.

| tstats summariesonly=true values(All_Changes.result) as description from
datamodel=Change_Analysis where index=wineventlog All_Changes.tag=
All_Changes.tag!=stopped by All_Changes.src, All_Changes.result_id, All_Changes.change_type,
All_Changes.action, All_Changes.status | rename All_Changes.* as *

Tags (1)
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!