Knowledge Management

Rule to detect 'windows audit log cleared'

Ghanayem1974
Path Finder

here is the start of my search but having issues figuring out the best way to capture the information i need.

| tstats summariesonly=true values(All_Changes.result) as description from
datamodel=Change_Analysis where index=wineventlog All_Changes.tag=
audit
All_Changes.tag!=stopped by All_Changes.src, All_Changes.result_id, All_Changes.change_type,
All_Changes.action, All_Changes.status | rename All_Changes.* as *

Tags (1)
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!