Hi guys, I want to detect a service ticket (TGS) request (Windows event code 4769) that is not preceded by one of the following corresponding events:
1. User ticket (TGT) request, Windows event code 4768.
2. Ticket renewal request, Windows event code 4770.
3. Logon event, Windows event code 4624.
The following is the SPL I wrote, but I found that there is a problem, could you help me to modify it?
index="xx"
| transaction user maxspan=24h maxpause=10h startwith=("Eventcode=4768", "Eventcode=4770", "Eventcode=4624") endswit="Eventcode=4769" keepevicted=true
| search Eventcode=4769 NOT (Eventcode=4768 OR Eventcode=4770 OR Eventcode=4624)
... View more