How do I search wineventlog security logs in an inputlookup table?

[Mitchellsch]

I have a list of privileged users from my inputlookup table and I want to know their dest ip. This is why I want to search my lookup table for privileged users. Then I want to take that output (dest_ip) and find with ones are RDP. This should give me the src_ip which I can then filter out which ones are on our IP subnet and which ones aren't.

This is the lookup table that returns my priv users.

|inputlookup name_of_my_table | search category=privileged

I want to search search withing sourcetype="WinEventLog:Security". So will I need to search within my lookup table, or will I need to use my lookup table to search within wineventlog?

Any help on this would be great. Thanks.

[woodcock]

It should be something like this (assuming that each row of name_of_my_table has a field called host and another called category and you have created a Lookup Definition for it):

sourcetype="WinEventLog:Security" | lookup name_of_my_table | where category="privileged"

[somesoni2]

I believe you would need to use the lookup table as the filter to show on the windeventlog security logs fromthose privileged users. May be something like this (update the field names)

sourcetype="WinEventLog:Security" [| inputlookup name_of_your_table | search category=privileged | table user ]

[Mitchellsch]

Thanks for the response. This is really similar to what I've been trying but I doesn't give me any results.

[somesoni2]

Check the field name for the USER in both sourcetype="WinEventLog:Security" and your lookup table. They should match OR your include a rename command in the subsearch.