# Console use to find new accounts created

**URL:** <https://discuss.elastic.co/t/console-use-to-find-new-accounts-created/275709>\
**Category:** Elastic Security\
**Created:** [June 11, 2021, 6:29pm UTC](https://discuss.elastic.co/t/console-use-to-find-new-accounts-created/275709 "2021-06-11T18:29:36Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![MKirby](https://avatars.discourse-cdn.com/v4/letter/m/e56c9b/32.png) [@MKirby](https://discuss.elastic.co/u/MKirby)\
**Post date:** [June 11, 2021, 6:29pm UTC](https://discuss.elastic.co/t/console-use-to-find-new-accounts-created/275709/1 "2021-06-11T18:29:36Z")

</div>

Good Afternoon. I have now been using and testing Elastic Stack for over a month and have been able to get pretty far in it. I am working with WinLogBeats, FileBeats and MetricBeats (All at version 7.12.1)now and one of the SRTMs that I need to answer is the ability to monitor account creation/deletion.

To that end I have created a new user account on my test machine. I know the time and date that I created the account, I have the Event Viewer log with the information regarding the process name, the Log group (Security) and the event id.

in terms of ELK configuration I have the xpack.monitoring.collection.enabled;  
xpack.security.enabled; (in ElasticSearch.yml)  
xpack.security.authc.api\_key.enabled (in ElasticSearch.yml)

WinLogBeats is running and generating data every day. I am trying to run a code similar to the following, but I know I am missing something that will bring up the information I am looking for.

Get WinlogBeat\*/\_search  
{  
"query": {  
"match": {  
"Event": "????"  
}  
}  
}  
}  
I have tried multiple combinations and cannot get any data.

If anyone can point me in the direction I should be going it would be greatly appreciated.

Thank you

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 9, 2021, 6:30pm UTC](https://discuss.elastic.co/t/console-use-to-find-new-accounts-created/275709/2 "2021-07-09T18:30:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.