Hello Everyone,
We currently have the below default search from ES to alert for anomalous audit log clearance activities on windows hosts. But what we have observed so far is, these alerts are triggered during a reboot or shutdown procedure as well. Can someone help me on, how do we tweak the below search to exclude the alerting if its because of a reboot/shutdown?
| from datamodel:"Change_Analysis"."Auditing_Changes" | where ('action'="cleared" OR 'action'="stopped") | stats max(_time) as "lastTime",latest(_raw) as "orig_raw",count by "dest","result"
What we do currently is, we investigate each alert and run a new search to check if there's an event code (like below) triggered during the same time-frame and then ignore if its because of a reboot/shutdown. But its getting painful. Hence we wanted to tweak the existing search from ES to exclude from alerting if its due to a reboot/shutdown. Can someone assist on this?
EventCode="1074" OR EventCode="6006" OR EventCode="6008" OR EventCode="6005" OR EventCode="6009" OR EventCode="1076"
