Forgive my ignorance if this has been answered elsewhere, I did my best to search for an answer but have not found it.
I am trying to compare three different search results for three separate events for specific time periods. Here are the strings I'm searching for:
1. user=BeerNFries OR ComputerName=xyz.local OR srcip="123.123.123.123"
2. user=Id10T OR ComputerName=123.local OR srcip="111.111.111.111"
3. user=PhishMe OR ComputerName=456.local OR srcip="222.222.222.222"
Where:
Event 1 occurred 9/17/2017 between 11:45 - 11:48
Event 2 occurred 8/19/2017 between 14:15 - 14:20
Event 3 occurred 9/12/2017 between 15:21 - 15:39
How would I be able to compare what happened during these times to look for similarities?
... View more