index=winevents host=servernames* EventCode=1511 OR EventCode=4647 | eval Sid=case(EventCode=1511,'Sid') | lookup ldap_identities.csv Sid OUTPUT identity | eval identity=upper(identity) | eval Account_Name=upper(Account_Name) | eval newidentity = coalesce(identity,Account_Name) | transaction newidentity startswith=EventCode=1511 endswith=EventCode=4647 keepevicted=true keeporphans=false | search closed_txn=0
Basically what I'm doing is looking for people logging in with temp profiles, and then logging out. If they log out this is ideal because it means they will most likely try logging into a different server to hopefully not get a temporary profile. I'm wanting to alert when the 'endswith' isn't met. The problem with keepevicted=true is that it's showing events for either the startswith, or endswith. I'm only wanting to see events where the 'endswith' is not met.
Any ideas?
