Hello everyone. There is a task of comparing the sessions of the user who came from the VPN and further with the same account in the RDP
if user vpn = user rdp session = "matched", otherwise = "not match"
Session vpn
index=fortigate eventtype=ftnt_fgt_event subtype=vpn (tunneltype="ssl-tunnel" OR tunneltype="ssl-web")
|transaction startswith=(logdesc="SSL VPN tunnel up") endswith=(command="SSL tunnel established")
|dedup tunnelid
Session rdp
index=windows source = WinEventLog:Microsoft-Windows-TerminalServices* (EventCode=1149 OR EventCode=21)
|mvexpand User
|search User!=NOT_TRANSLATED
|rex field=User "(?<user>[\w+\.\w+]*$)"
|table _time,user,Source_Network_Address
I haven't built the query myself yet.
grateful for any thoughts on request
In general, run one query then run other in an append. Use stats to group the events by the common field(s) (user, in this case). Compare the fields in the combined events to see which are "matched".
index=fortigate eventtype=ftnt_fgt_event subtype=vpn (tunneltype="ssl-tunnel" OR tunneltype="ssl-web")
|transaction startswith=(logdesc="SSL VPN tunnel up") endswith=(command="SSL tunnel established")
|dedup tunnelid
```Replace 'something' with the name of the field containing the user's name```
| rename something as user
| append [ search index=windows source = WinEventLog:Microsoft-Windows-TerminalServices* (EventCode=1149 OR EventCode=21)
|mvexpand User
|search User!=NOT_TRANSLATED
|rex field=User "(?<user>[\w+\.\w+]*$)"
|table _time,user,Source_Network_Address ]
| stats values(*) as * by user
| eval session=if(isnotnull(tunnelid) AND isnotnull(Source_Network_Address),"matched", "not matched")