Hello,
I am using two searches for seeking two windows events 4732 and 4733. I want to print into a new table events which registered only one of two events. For example, usually when local admin add in any groups at servers windows, a security event with number 4732 is created. And after deleting this user, Windows creates the new event 4733.
I want to try find in events 4732 or 4733, which ones registered only in one of events 4732 or 4733.
I used search:
(source="WinEventLog:Sec*" index="wineventlog" EventCode=4732 ) OR (source="WinEventLog:Sec*" index="wineventlog" EventCode=4733) | rex field=_raw "Message=(?\S+.*)" | eval Description=Descript | rex field=_raw "Subject:\s+.*\s+Account Name:\s+(?\S+)" | eval CDSID=UserName | rex field=_raw "Member:\s+Security ID:\s+(?\S+)" | eval MCDSID=MemberName | rex field=_raw "Group:\s+.*\s+Group Name:\s+(?\S+.*)" | eval LocalGroup=GName | rename host as Host EventCode as "Event Code" MCDSID as "Member Name" LocalGroup as "Local Group" _time as Date | stats Count by Host, "Event Code", Description, CDSID, "Member Name", "Local Group", Date | fieldformat Date =strftime(Date,"%x %X") | table Host, "Event Code", Description, CDSID, "Member Name", "Local Group", Date, Count
How can I compare and print only unique event which not the same account name in both events 4732 and 4733 at the same time?
... View more