Assuming you have the Windows TA deployed you can simply do:
index=YOURWINDOWSINDEX eventtype=windows_logon_success user=YOURUSERNAME | table _time, user, src_ip
Alternatively, look for the specific EventCode used by logon events:
index=YOURWINDOWSINDEX EventCode=4624 user=YOURUSERNAME | table _time, user, src_ip
Thanks for the reply! what is windows ta?
What do I use for "Yourwindowsindex" too? Can I search all indexes?
Hi, you can search all the indexes but that would be slower than just searching the one containing your windows logs. If you are not sure it might be because you are only using one default index called "main".
Alternatively you can search for your index name first and then refine your query to use that index name instead of all. There are several ways to do this (assuming your sourcetype names are correct too):
| metasearch sourcetype="WinEventLog:Security" index=* | head 1 | table index index=* EventCode=4624 | head 1 | table index
Try one of those and see if that helps.
Hi @mattj81, did this solve your problem?
If yes, please don't forget to mark it as answered so that others can benefit from it.
If not, can you let us know what's going on so that we can try to help?
Hi, sorry for the lack of response! Ive opened a support ticket now as its not right our DC doesn't appear to be sending events via snare so something isn't right 😞