compare fields by vpn session user and rdp session

[nalia_v]

Hello everyone. There is a task of comparing the sessions of the user who came from the VPN and further with the same account in the RDP
if user vpn = user rdp session = "matched", otherwise = "not match"

Session vpn

index=fortigate eventtype=ftnt_fgt_event subtype=vpn (tunneltype="ssl-tunnel" OR tunneltype="ssl-web") 
|transaction startswith=(logdesc="SSL VPN tunnel up") endswith=(command="SSL tunnel established")
|dedup tunnelid

Session rdp

index=windows source = WinEventLog:Microsoft-Windows-TerminalServices* (EventCode=1149 OR EventCode=21)
|mvexpand User
|search User!=NOT_TRANSLATED
|rex field=User "(?<user>[\w+\.\w+]*$)"
|table _time,user,Source_Network_Address

I haven't built the query myself yet.

grateful for any thoughts on request

[richgalloway]

In general, run one query then run other in an append.  Use stats to group the events by the common field(s) (user, in this case).  Compare the fields in the combined events to see which are "matched".

index=fortigate eventtype=ftnt_fgt_event subtype=vpn (tunneltype="ssl-tunnel" OR tunneltype="ssl-web") 
|transaction startswith=(logdesc="SSL VPN tunnel up") endswith=(command="SSL tunnel established")
|dedup tunnelid
```Replace 'something' with the name of the field containing the user's name```
| rename something as user
| append [ search index=windows source = WinEventLog:Microsoft-Windows-TerminalServices* (EventCode=1149 OR EventCode=21)
  |mvexpand User
  |search User!=NOT_TRANSLATED
  |rex field=User "(?<user>[\w+\.\w+]*$)"
  |table _time,user,Source_Network_Address ]
| stats values(*) as * by user
| eval session=if(isnotnull(tunnelid) AND isnotnull(Source_Network_Address),"matched", "not matched")