I have a list of privileged users from my inputlookup table and I want to know their dest ip. This is why I want to search my lookup table for privileged users. Then I want to take that output (destip) and find with ones are RDP. This should give me the srcip which I can then filter out which ones are on our IP subnet and which ones aren't.
This is the lookup table that returns my priv users.
|inputlookup name_of_my_table | search category=privileged
I want to search search withing
sourcetype="WinEventLog:Security". So will I need to search within my lookup table, or will I need to use my lookup table to search within wineventlog?
Any help on this would be great. Thanks.
It should be something like this (assuming that each row of
name_of_my_table has a field called
host and another called
category and you have created a
Lookup Definition for it):
sourcetype="WinEventLog:Security" | lookup name_of_my_table | where category="privileged"
I believe you would need to use the lookup table as the filter to show on the windeventlog security logs fromthose privileged users. May be something like this (update the field names)
sourcetype="WinEventLog:Security" [| inputlookup name_of_your_table | search category=privileged | table user ]