So I am trying to output audit failures in a readable manner while displaying relevant data.
I am trying to output the count for the number of times that Process_Name has failed and display its top Task_Category and have this table for each computer_name the user logged in on.
I am trying to get a table that looks like this
Computer_Name | Process_Name | Task_Category | count
_______________________________________________________________
asdfkjhfu$ |wineventExample1 |Login |20
|wineventExample3 |Sensitive Priv |30
|wineventExample2 |derp |10
________________________________________________________________
asdflkja$ |wineventExample1 |Login |60
|wineventExample5 |Sensitive Priv |40
|wineventExample2 |derp |20
My Search for now looks as follows (I know I'm not close, but this will give you an idea of field names/sourcetypes:
sourcetype=wineventlog:forwardedevents Account_Name=Alpha Keywords="Audit Failure"|stats count(Process_Name) as count by Process_Name|appendcols [search sourcetype=wineventlog:forwardedevents Account_Name=Alpha Keywords="Audit Failure"|top limit=1 TaskCategory by Process_Name|fields TaskCategory]|table Computer_Name, Process_Name, TaskCategory,count
This outputs a table like this
Computer_Name | Process_Name | Task_Category | count
_______________________________________________________________
|wineventExample1 |Login |20
|wineventExample3 |Sensitive Priv |30
|wineventExample2 |derp |10
Try this:
sourcetype=wineventlog:forwardedevents Account_Name=Alpha Keywords="Audit Failure"| stats count BY Computer_Name Process_Name Task_Category | stats list(*) AS * by Computer_Name
Try this:
sourcetype=wineventlog:forwardedevents Account_Name=Alpha Keywords="Audit Failure"| stats count BY Computer_Name Process_Name Task_Category | stats list(*) AS * by Computer_Name
That worked!!! Really appreciate your help!
I knew there was a list command, but I literally couldn't find any examples for it, so I got stuck haha.