How can we deal with a negation of a transaction?

[danielbb]

We have a working code that captures transactions from the firewall into the windows servers and all is perfect as the code captures these transactions.

(index=wineventlog  OR 
(index=checkpoint action=Accept) 
| eval destination_ip = coalesce(Source_Network_Address,dest_ip) 
| eval action-{index}= action 
| eval src-{index}= src 
| transaction destination_ip maxspan=60s startswith=action-checkpoint="Accept" endswith=action-wineventlog="success" keeporphans=1 unifyends=1 
| search src-wineventlog = * AND src-checkpoint = * 
| lookup(s) ....
| table <fields>

However, being the cyber team, we are trying to find the negation of a transaction and we don't know where to start.

Any advice, by any chance?

[wcates1]

So figure out how to do this (was not easy). You have to eval a test field with some unique host ID and the timestamp and then negate the transaction results based on that - putting the new test field together inside of the subsearch and outside of it before you do the subsearch:

index=windows* EventCode=1
| eval TESTFIELD=ip_address._time
| search NOT
[ search index=windows* (EventCode=1 OR EventCode=2 OR EventCode=3)
| transaction ip_address startswith=EventCode=1 endswith=(EventCode=2 OR EventCode=3) maxspan=12m
| eval TESTFIELD=ip_address._time
| fields TESTFIELD
| table TESTFIELD ]
| fillnull value=NULL
| table ip_address EventCode host _time TESTFIELD

[richgalloway]

Please explain what you mean by "negation of a transaction".