hi guys, I want to detect a service ticket request (Windows event code 4769) and one of the following corresponding events does not appear before the service ticket request:
1. User Ticket (TGT) request, Windows event code 4768.
2. Ticket renewal request, Windows event code 4770.
I want to search for a user with 4769 events over a continuous period, but the user has no 4768 or 4770 events during that time, instead of 4769 and no 4768 or 4770 users.
Not during this period, but the user did not have 4768 or 4770 events prior to this period.
Hi @Dustem,
let me understand: 4768 or 4770 should be before the 4769 and you want an alert if tey are missing or tey aren't before, is is correct?
Ciao.
Giuseppe
Hi @Dustem,
let me understand: you want to discover if, in one time period, there was a Windows EventCode=4769 but not a Windows EventCode=4770, is it correct?
I suppose that you have a common ID to correlate the events.
If this is your requirement, you could try something like this:
index=wineventlog EventCode IN (4769,4770)
| stats dc(EventCode) AS EventCode_count BY TGT_Id
| where EventCode_count=1
Cioao.
Giuseppe
Hi gcusello,
My description may not be accurate.
I want to detect eventcode=4769 and then detect whether the user of this event(eventcode=4769) has eventcode=4768 or eventcode=4770 before it.
Hi @Dustem,
the approach is the same:
index=wineventlog EventCode IN (4768,4769,4770)
| stats
dc(EventCode) AS EventCode_count
values(EventCode) AS EventCode
BY user
| where EventCode_count=1 AND EventCode=4769
in this way you have the users where there's the EventCode 4769 but not one of the others.
Ciao.
Giuseppe