Alert triggering on an entry not in inputlookup file

[cnoulin]

Hello, i have made an alert as follow :

[|inputlookup admin_groups.csv | table "query" as Group_Name ] | search EventCode=4728

she work well but i have strange behavior.
Sometime she trigge with a Group_Name that is not in the list..
How explain that ?

Thanks in advance

[cnoulin]

just a question.
with my alert i want to say :
if a group_name in my file in the "query" field correspond in group_name in my log it will fire
Is it ok ?
sorry for my english

[lakshman239]

Assuming you have your logs in index=wineventlogs and if you want to alert based on the field value from your lookup [ I assume 'query' is a column in your lookup table], you could something like this

index=wineventlog [|inputlookup admin_groups.csv | field query | rename query AS Group_Name | format] | search EventCode=4728

This uses the sub-search from the lookup which provides values like (Group_Name=4624 OR Group_Name=4728) etc.. and if your lookup table has 4728, it will trigger an alert.

[cnoulin]

4728 is my event_code , i thing you mean Group_Name=one_of_the_group_in_the_query_field ?

My real alert is
if a group_name in my file in the "query" field correspond in group_name in my log AND with EventCode=4728

My source log is WinEventLog:ForwardedEvents

[lakshman239]

can you pls send a rows of the lookup table with field/column and sample search [ mask any sensitive data]?

[cnoulin]

the file is as follow

query
...
DnsAdmins
DnsUpdateProxy
Domain Admins
Domain Admins Restriction
Domain Computers
Domain Controllers
COMPUTER1 Admins
...

thanks for your help

[cnoulin]

and my index=windows

[cnoulin]

thank you for your answer, i'll do the modification.
you think it could be the cause of the behavior ?

[lakshman239]

If you have a field called 'query' in your lookup and want to change/rename as Group_Name, pls use the below

[|inputlookup admin_groups.csv | field query | rename query AS Group_Name ] | search EventCode=4728