Security

Can any one help with a search language that could determine system logins after core hours?

New Member

Can any one help with a search language that could determine system logins after core hours?

Tags (2)
0 Karma

Ultra Champion
index=your_index EventCode=7001 OR EventCode=7002 sourcetype=wineventlog
| eval core_time_start="08:00:00", core_time_end="17:00:00"
| foreach core_time*
    [eval <<FIELD>> = tonumber(strftime(strptime('<<FIELD>>',"%T"),"%H%M%S"))]
| where tonumber(strftime(_time,"%H%M%S")) < core_time_start OR tonumber(strftime(_time,"%H%M%S")) > core_time_end

Hi, @essibong1

  1. your system
  2. your core time
  3. your log

I do not know the details.
This query provides non-standard Windows logon and logoff times logs.

0 Karma