Hmm so the search does run, but it is never producing results. I tested multiple variations, but this is the jist: index=main (sourcetype="DetectionName" AND detect_name="Bypass UAC") OR sourcetype="ProcessInfo" OR sourcetype="FalsePositive" | eventstats values(sourcetype) as sourcetype by Detection_id | where sourcetype!="FalsePositive" AND sourcetype="DetectionName" AND sourcetype="ProcessInfo" | stats values(ComputerName) as ComputerName values(detect_description) as detect_description values(detect_name) as detect_name values(detect_scenario) as detect_scenario values(Process) as Process values(CommandLine) as CommandLine by Detection_id When I take away the where clause it runs but of course produces a long list of stuff where the majority are missing key field values (detect_description, detect_name, detect_scenario are all unique fields in the DetectionName sourcetype while Process and CommandLine are unique fields in the ProcessInfo sourcetype).
... View more
