Need to exclude hosts which matched with event 4608 windows is starting up within 5 minutes

[HPACHPANDE]

Below is the query which included all the events for windows shutdown and starting up 

want to exclude host when event 4608 is observed within 5 minutes

index =windows product=Windows
EventCode="4609" OR EventCode="4608" OR EventCode="6008"
| table _time name host dvc EventCode severity Message

please share the query.
Thanks

[yuanliu]

Do you mean something like this?

index =windows product=Windows
(EventCode="4609" OR EventCode="4608" OR EventCode="6008")
NOT (EventCode=4608 earliest=-5m)
| table _time name host dvc EventCode severity Message

[HPACHPANDE]

HI @yuanliu ,

Thanks for sharing query on this matter.

Have reviewed your query concern is like you have excluded the windows starting up event within 5 minutes but it how it will consider the specific "host".

As per my understanding it should be host specific if single host got shutdown and got started up again within 5 minute should not trigger any alert.

[yuanliu · Accepted solution]

So you are trying to exclude any event from a host if it has 4608 in the past 5 minutes.  Try

index =windows product=Windows
(EventCode="4609" OR EventCode="4608" OR EventCode="6008") NOT 
    [search index =windows product=Windows EventCode=4608 earliest=-5m
    | stats values(host) as host]
| table _time name host dvc EventCode severity Message

[gcusello]

Hi @HPACHPANDE ,

please try something like this:

index =windows product=Windows
EventCode="4609" OR EventCode="6008" OR (EventCode="4608" AND _time<now()-300)
| table _time name host dvc EventCode severity Message

I'm not sure that it's possible to add the last condition in the main search, please try, if doesn't run, pleaase try this:

index =windows product=Windows
EventCode="4609" OR EventCode="4608" OR EventCode="6008"
| where EventCode="4608" AND _time<now()-300
| table _time name host dvc EventCode severity Message

Ciao.

Giuseppe