Hi! I am trying to create a report which I will use as a dashboard panel, to show me who has been copying and pasting files and folders. I want to know what has been copied and pasted, and where they have been pasted to. So far I have managed to look at all files read and written but I am unable figure out how to close my search down to show me only instances that have both "read" and "write" Accesses, or Is there a better way to do this? My search string in progress is below: index=windowslogindex EventCode=4663 AND Object_Type=File Accesses="ReadData (or ListDirectory)" | Append [search index=windowslogindex EventCode=4663 AND Object_Type=File Accesses="WriteData (or AddFile)"] ... View more