Display all enabled user event without a corresponding create event and mark the time

[sijssennagger]

Hello everybody,

I'm trying to figure out the following problem - "Display all enabled user event without a corresponding create event and mark the time" and I just can't get it to work.
What I currently can come up with is a table with all enabled users but without the corresponding time of the event:

source="WMI:WinEventLog:Security" (EventIdentifier="4720" OR EventIdentifier="4722") | eval account_name_lookup = mvindex(Account_Name,1) | chart count by account_name_lookup EventIdentifier | search 4720=0 | table account_name_lookup

As soon as I do the chart count command the time fields disappears, which kinda make sense. I've been trying to do part of the search again ans comparing the table with the "Account_name" field but I can't get it to work. It seems to me that this should be a fairly simply search, am I overlooking something?

[somesoni2 · Accepted solution]

Try something like this

source="WMI:WinEventLog:Security" (EventIdentifier="4720" OR EventIdentifier="4722") | eval account_name_lookup = mvindex(Account_Name,1) | stats values(EventIdentifier) as EventIdentifiers, first(_time) as _time by account_name_lookup | where mvcount(EventIdentifiers)=1 AND mvindex(EventIdentifiers,0)="4722" | table account_name_lookup

[sijssennagger]

That worked great, thanks for your help!
Next I'm going to figure out what these commands actually do 😉