About Aufex

Aufex · ‎11-30-2017

Hello, I want to identify the login and logouts for each user on a server. I use the event_id 4624 (logon) and 4634(logoff). the problem is that Windows generates multiple events for only one login/logoff. It seems that they share the same login_id. so I try something like: host="server a" user="allice" (EventCode=4624 OR EventCode=4624 ) now I need something like: | where login_id= login_id So that I get only 2 events for one login/logoff , but for all users and over time 🙂 Thanks for reading.

Aufex · ‎11-28-2017

perfect, thank you!!

Aufex · ‎11-28-2017

the chart only show you the users and the number of events of each user. the table should show you user,NAS_IP, count(user) there can only be one NAS_IP for each user

Aufex · ‎11-28-2017

Hello, my querry 'sourcetype="xxx" radius authentication failed | chart count by user | sort - count' gives me a nice little chart und a table under it. My problem is that i can not add an additional collum "NAS_IP_Adress". can you give me any tips? thanks

Aufex · ‎08-01-2017

Hi, i audit my firewall with action=blocked earliest=-1d@d latest=@d | stats count by host src_zone dest_zone | sort - count that work fine and gives me a good overview. Now i try to compare each resulting count with the counts given 8 days ago. when i try to | append [] splunk gives an error. can you help me? thanks

Aufex · ‎08-01-2017

thank you. yes ports change a lot. i think its much smarter to display the zones 🙂

Aufex · ‎08-01-2017

Hi, i try to identify how often a user account was loged on. the problem is that the DC generates multible 4624 in very short time (different processes?). is there any best practice soltion to get a correct number of logon events? there are some topic whit that question but i cant find any useable solution. i tryes with | debuc Logon_GUID but that dont work 😞 sourcetype="WinEventLog:Security" EventCode=4624| eval Account_Name=if(Account_Name="-", (mvindex(Account_Name,1)), Account_Name)| eval Account_Domain=if(Account_Domain="-", (mvindex(Account_Domain,1)), Account_Domain)| dedup Logon_GUID | chart count by Account_Name | sort - count

Aufex · ‎07-31-2017

Hi there, i try to buildup a firewall report: "sourcetype="firewall" action=blocked | table host src dest src_port dest_port" this gives me endless rows, and many of them are dublicated. i try to delete all the dublicates and count them so that i have something like HOST | SRC | DEST | SRC_PORT | DEST_PORT | COUNT that would give a nice overview.

Posts	8
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎07-31-2017

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

How can I identify login and logoff times for user...

adding a collum in a "...| chart count by x"

compare | stats count by x y z over different days

best practice multiple eventID 4624 for one logon

Count matching values on seperated fields