Transaction based alert trigger for EventCode=4740 showing previous 60 minutes events

[soniquella]

Good morning.

I am looking to generate an alert for when EventCode=4740 (User lockout) is shown in the event logs from my DC. I would like the report of triggered alert to show the previous 60 minutes (or maxevents=15) leading up to the EventCode=4740 lock out (trigger).

Ultimately this would create a report we could send to the user to show that they are locked out and how the lock out was generated.

index=myindex sourcetype="WinEventLog:Security" EventCode=4740 OR EventCode=4771 Account_Name=Username | transaction startswith=EventCode=4771 endswith=EventCode=4740 maxspan=1h

This is my current attempt but it is not producing the information that I need in the format that I need.

If anyone has any ideas then they would be gratefully appreciated.

Thanks,

Rob.

[soniquella]

Hi.

Thanks for your quick response. One thing I was not aware of was the inclusion of the EventCode=4740 within the body of the EventCode=4771 event. I could not understand why I was seeing two EventCode's where I was expecting only 4770 as the most recent event but actually only seeing EventCode=4771

I believe that your suggestion should work perfectly.

Thank you.

[mayurr98]

the most recent event will be at down as time is in ascending order. so | transaction startswith=eval(EventCode=4771) endswith=eval(EventCode=4740) maxspan=1h maxevents=15 will check within 1h the event that startswith 4771 and endswith 4740. maybe it is because of maxevents=15 if you remove that you should get events with 4740 as well. so basically within 15 events if you get both of these then only it will show. try removing it or adjusting it.

[soniquella]

I appreciate your help.

This was my finished search which seems to be getting the results:

index=myindex sourcetype="WinEventLog:Security" EventCode=4740 OR EventCode=4771 | transaction Security_ID startswith=eval(EventCode=4740) maxspan=1h maxevents=10 unifyends=false

Again, much appreciated.

[mayurr98]

I have converted to an answer. Upvote/accept if it is working for you!

[mayurr98 · Accepted solution]

can you please try this:

index=myindex sourcetype="WinEventLog:Security" EventCode=4740 OR EventCode=4771 Account_Name=Username 
| transaction startswith=eval(EventCode=4771) endswith=eval(EventCode=4740) maxspan=1h maxevents=15