Detecting Account sharing with winlogbeat

Elastic Stack Elasticsearch
1

Hi There,

Am trying to write a query for detecting the account shares among the users .I dont know how to execute it.

I have field called event_data.TargetUserName and event_data.IpAddress, i would like to search for query some thing like

At 10:00am > [ event_data.TargetUserName = abc , event_data.IpAddress=10.0.0.1 ]
At 10.05am > [ event_data.TargetUserName = abc , event_data.IpAddress=10.0.0.5 ]

there is possiblity of user having multiple machines but still could be useful to track .May be ip in different subnets reflecting in different location

Thanks,
Raj

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.