Hello Experts, We've got an alert which gets triggered if service is installed on the windows host. index=winevents sourcetype="WinEventLog:System" EventCode=7045 We want to whitelist combination of service and host. For example if service A is installed on host A then it should be fine. Eventually, list of host-service would grow so we would like to use lookup table. We have whitelisted single field (src in below example) by creating the lookup table and adding below line in the condition and it works perfectly alright. | join type=left src [ | inputlookup whitelist.csv | search search_name=my search name exclusion_field=src | rename exclusion_value AS src | eval whitelisted="true"] | where NOT whitelisted="true" I tried adding multiple fields in above line but doesn't seem to be working. What is the best way to address the requirement? Thanks ... View more

Hi All, We've set up an alert to flag AD Service account passwords are reset. Below is the alert condition: index=winevents sourcetype="WinEventLog:Security" EventCode=4724 OR EventCode=627 OR EventCode=628 OR EventCode=4723 user="_s*" | fields _time member_id user EventCode EventCodeDescription Message | eval intelSubject="ad_service_account_password_reset " + member_id | eval intelSource="Security Monitoring" | rename member_id AS "Actioning User" user AS "Target User" | table _time intelSubject intelSource "Actioning User" "Target User" EventCode EventCodeDescription Message However, we're seeing a lot of false positives. When new service accounts are created, we see the subsequent password reset event. Hence, we would like to tune the alert in such a way that service account password reset should only get triggered if the same user account hasn't been created within last hour of the password reset event. I've tried to use options listed out in below thread but no joy. https://answers.splunk.com/answers/38318/search-for-event-a-and-not-event-b-within-a-given-period-of-time.html?utm_source=typeahead&utm_medium=newquestion&utm_campaign=no_votes_sort_relev Any pointers or help much appreciated!! Thanks ... View more