@to4kawa you had it praticly right, with a few erros,
index=tenable (module=auth message="*login*") OR (module=user (message="*modified*password*" OR message="*created user*"))
| rex field=message "\[(?'usr'.*?)\].*\[(?'usr_mod'.*?)\]"
| transaction startswith="created user" endswith="*modified*password*"
| where eventcount=3 AND usr=usr_mod
| stats values(user) as AllUsers, values(usr_mod) as ModifiedUsers | stats values(*) as * by AllUsers
| eval check = if(match(ModifiedUsers,"^".AllUsers."$"),1,0)
| stats values(eval(if(check=0,AllUsers,NULL))) as AllUsers
You had
modefied and it was modified
missing " at the end of the first and second line
where is missing an AND between the conditions
fix it so that i can call it an Correct awnser plss
Btw tyy
... View more