Hi All,
I am trying to find:
Users using event code 4769
The count of computers a user connects to within 1hr which is greater >4
The count of the event code 4769 >50 by that user within 1hr
I have got myself very confused any help would be appreciated!
sourcetype = windowseventcodes Event_Code=4769
| bucket _time span=1h
| stats count by ComputerName AccountName
| stats count(ComputerName) as CNC by AccountName
| eventstats sum(CNC) as total_count
sourcetype = windowseventcodes Event_Code=4769
| bucket _time span=1h
``` count events by computer name and account within 1hr bins ```
| stats count by ComputerName AccountName _time
``` count computers user has used and total events for user within 1hr bins ```
| stats count(ComputerName) as CNC sum(count) as total_count by AccountName _time
``` select the rows you want ```
| where CNC > 4 AND total_count > 50
sourcetype = windowseventcodes Event_Code=4769
| bucket _time span=1h
``` count events by computer name and account within 1hr bins ```
| stats count by ComputerName AccountName _time
``` count computers user has used and total events for user within 1hr bins ```
| stats count(ComputerName) as CNC sum(count) as total_count by AccountName _time
``` select the rows you want ```
| where CNC > 4 AND total_count > 50