×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
itssuresh07
New Member
Member since: ‎07-14-2021
‎07-20-2021
Community Statistics
Posts 2
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎07-14-2021
View All

Re: How to correlate 4688 Process created and Logo...

by in Splunk Enterprise Security
‎07-20-2021 11:34 AM
‎07-20-2021 11:34 AM
I have tried the below query with maxspan=-1 maxpause=-1 but I am not getting the Hostnames. Can you please help me in getting Correct fields for matching the Logon_ID events in Splunk for 4624 and 4688. Or is there any other way for Correlating 4624 and 4688 events.  I need to verify who has logged into the machine within the session created and ran the process from his account. ... View more

How to correlate 4688 Process created and Logon 46...

by in Splunk Enterprise Security
‎07-14-2021 12:52 PM
‎07-14-2021 12:52 PM
Hi, Can someone help me in correlating 4688 Process created and Logon 4624 events? I tried using the Transaction  and Stats command but unable to get the proper results. When I use the Transaction command with Logon_ID field I could not able to correlate both 4624 and 4688 events. Can some one help me in fixing the query.   (EventCode=4624 LogonType=3) OR ((EventCode=4688) | transaction Logon_ID host startswith="4624" endswith="4688"   Can someone help me in getting the Correct field for Correlating the 4688 and 4624 events in splunk ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎07-20-2021 02:56 PM