bowesmana' Thank you for your response. I am new to Splunk. I do not understand all the code you provided. My next question is how do I incorporate the actual search using your code.  Here is the search:   index="winlogs" host=* source="WinEventLog:Security" Eventcode=4624 Logon_Type=2 OR Logon_Type=7 NOT dest_nt_domain="Window Manager" NOT dest_nt_domain="Font Driver Host"  | sort_time   | convert ctime(_time) as timestamp  | table, timestamp,EventCode,Logon_Type,Account_Name,RecordNumber,status  

Hi @linaaabad  This is a 3rd party Splunk app that relies on the Splunk Add-on For Salesforce so it's likely that it has some compatibility. Splunk App for Salesforce: https://splunkbase.splunk.com/app/1931 Hope that helps

You need to tell volunteers what "doesn't work" means.  This is a phrase to be avoided in the best of scenarios. This said, if Target_Account_Name and Subject_Account_Name are both available in raw events, maybe you are looking for distinct_count (aka dc) instead of count? Something like source="WinEventLog:Security" EventCode IN (628, 627, 4723, 4724) | stats dc(Target_Account_Name) by Subject_Account_Name Hope this helps.

Thank you so much for your fast reply! Unfortunately, adding a filter after my decision block did not fix my problem. In the debugger, it shows the filter as working after my decision, but still all 5 artifacts make it through to my Post block. I'm very new to SOAR/phantom so I apologize for my ignorance; I had edited some artifact's CEF so that they have unique values that I then put into the decision/filter so that they will specifically be pulled as intended. It still shows that even after the filter working, all 5 are being posted to my Confluent stream. When you're pulling multiple artifacts from a container, are they "tied" together as in they will be moved together through a playbook as long as at least one of them proves true for a decision or filter? Because that's what is appearing to happen.  Thank you again for your assistance in this matter!

What I have done is to add these lines at the end of my query, from my initial testing it works. Is this what you were getting at ? | eval hour=strftime(now(),"%H") | eval weekday=strftime(now(),"%w") | where NOT (hour IN (13,14)) AND weekday != 0 This would not generate any results if its Sunday between 1 AM through 2:59 AM ?

Your solution make sense but I am still getting this error when I try to run the search.  External search command 'ldapsearch' returned error code 1. Script output = "error_message=invalid filter ".    

@phanTom Thank you for your answer, it will be very useful. I was just asking why from the events that come to me it seems as if my playbook were running in more than one event at the same time, if it were running in 2 events or more at the same time it wouldn't work for me.I need it to execute one event at a time.