Watchlist Insertion

[julirodr]

Hi,

I want put an alert witch detect non authorized connection. In order to do that I have integrate some workstation logs. I want to know what users has been login on these workstations. So, I have 2 recomendations:
- I want target worksation impacted (for example, I want check connection only on HOSTNAME1, HOSTNAME2, HOSTNAME3. Not in HOSTNAME4)
- I want exclude normal user (for example, USER1 is authorized to log in HOSTNAME1)

Do you have any idea on how do to that?

---

I want to do that:

Event 4624 (Security) AND HOSTNAME IN $WATCHLIST(HOSTNAME) AND USERNAME NOT IN $WATCHLIST(USERNAME)

Thanks for your help.

Regards.

[lguinn2]

I suggest that you build a lookup table to do this. If you haven't used lookup tables, you might want to follow the tutorial to set it up. In the lookup definition, be sure to set the default value to "No Match".

Sample watchlist.csv:

hostname,authorizedUser
host01,userA
host01,userB
host02,userB
host03,userC

Search:

EventCode=4624
| lookup watchlistLookup hostname as host OUTPUT authorizedUsers
| where hostname != ""No Match"
| makemv delim="," authorizedUsers
| where NOT mvfind(authorizedUsers,username) 

Set your alert for "number of events > 0". I am not sure that you actually need the | makemv delim="," authorizedUsers. I also suggest that you try this solution one step at a time, so you can check it for errors and understand better how it works.

[lguinn2]

It sounds like a typographical error to me. If you would copy your search string into another comment, then someone might be able to see the problem.

[julirodr]

Hello,

Thanks for your help.

This search doesn't work and I don't know why. I have put the search and I have the following error:

Error in 'where' command: Typechecking failed. 'XOR' only takes boolean arguments.

The search job has failed due to an error. You may be able view the job in the Job Inspector.

Do you have any idea about this error?

Thanks,
Regards.