# Creating watcher on windows event id 4625 with multiple conditions
**URL:** https://discuss.elastic.co/t/creating-watcher-on-windows-event-id-4625-with-multiple-conditions/231851
**Category:** Beats
**Tags:** elastic-stack-alerting, winlogbeat
**Created:** [May 9, 2020, 4:10pm UTC](https://discuss.elastic.co/t/creating-watcher-on-windows-event-id-4625-with-multiple-conditions/231851 "2020-05-09T16:10:24Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@tahseen\_fatima](https://discuss.elastic.co/u/tahseen_fatima)
#### Post date: [May 9, 2020, 4:10pm UTC](https://discuss.elastic.co/t/creating-watcher-on-windows-event-id-4625-with-multiple-conditions/231851/1 "2020-05-09T16:10:24Z")
Hi,
I want to create alert for Windows Security Event Log
and when the event matches EventID (custom) is any of 4625
and when at least 3 events are seen with the same Username in 24 hour(s).
Here is my watcher.
```
{
"trigger": {
"schedule": {
"interval": "20s"
}
},
"input": {
"search": {
"request": {
"search_type": "query_then_fetch",
"indices": [
"siem-os-*"
],
"rest_total_hits_as_int": true,
"body": {
"size": 1,
"query": {
"bool": {
"must": [
{
"term": {
"EventID": {
"value": "4625"
}
}
},
{
"exists": {
"field": "EventID"
}
}
],
"filter": {
"range": {
"@timestamp": {
"gte": "now-24h"
}
}
}
}
},
"aggs": {
"user_name": {
"terms": {
"field": "UserName.keyword"
}
}
}
}
}
}
},
"condition": {
"compare": {
"ctx.payload.hits.total": {
"gte": 0
}
}
},
"actions": {
"index_1": {
"index": {
"index": "alert-for-4625"
}
}
}
}
```
Kindly help me with writing condition.
Kindly help,
Tahseen
---
### Author:  [@tahseen\_fatima](https://discuss.elastic.co/u/tahseen_fatima)
#### Post date: [May 9, 2020, 4:12pm UTC](https://discuss.elastic.co/t/creating-watcher-on-windows-event-id-4625-with-multiple-conditions/231851/2 "2020-05-09T16:12:08Z")
I m stuck in writing condition for
**when at least 3 events are seen with the same Username in 24 hour(s).**
Please have a look on it and reply to it.
Thanks
---
### Author:  [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [May 11, 2020, 1:47pm UTC](https://discuss.elastic.co/t/creating-watcher-on-windows-event-id-4625-with-multiple-conditions/231851/3 "2020-05-11T13:47:15Z")
please take a little bit more time to help us understand where your problem is. You need to use a [script condition](https://www.elastic.co/guide/en/elasticsearch/reference/7.6/condition-script.html) that checks your buckets. You could add the `min_doc_count` to your `terms` agg and then check for the existence of a bucket.
You can basically do a `ctx.payload.aggs.user_name.buckets.size() > 0` (on top of my head without verifying).
---
### Author:  [@tahseen\_fatima](https://discuss.elastic.co/u/tahseen_fatima)
#### Post date: [May 12, 2020, 7:11am UTC](https://discuss.elastic.co/t/creating-watcher-on-windows-event-id-4625-with-multiple-conditions/231851/4 "2020-05-12T07:11:26Z")
Hi,
This is working fine, but i want to specify the size of doc count inside of bucket . There are multiple doc count inside buckets.
```
"condition": {
"script": {
"source": "if (ctx.payload.aggregations.user_name.buckets.size() > 3) return true; else return false;",
"lang": "painless"
}
},
```
given below is the output of above condition,
But I want to apply condition on the doc count inside of this bucket
```
aggregations.user_name.buckets
{
"doc_count": 154,
"key": "xyz"
},
{
"doc_count": 92,
"key": "abc"
},
{
"doc_count": 80,
"key": "Administrator"
},
```
waiting for response
Thanks in advance
Tahseen
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 9, 2020, 7:11am UTC](https://discuss.elastic.co/t/creating-watcher-on-windows-event-id-4625-with-multiple-conditions/231851/5 "2020-06-09T07:11:29Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.