Hi, want to create a search to find anyone who does changes to the sAMAccountName  So sAMAccountName could be sAMAccountName=cdf or sAMAccountName=abc sAMAccountName=abc  if anyone changes this to sAMAccountName=abc1 triggers an alert.      ... View more

Hi, I am trying to create an alert for hosts that are communicating to the internet. Want to know the destinations.  But have a lot of trusted destinations to exclude (Aprox. 2800).  The below query gives me all the trusted destinations+other.  index=net sourcetype=proxy dest!=10.1.* 10.2.* sc_status=200 c_ip IN (10.1.10.* 10.1.11.* ) | lookup dnslookup clientip as c_ip OUTPUT clienthost as DNSName | stats count by c_ip DNSName dest sc_status Please let me know of any solution.    ... View more