Elastic Query for alerts Windows

Elastic Stack Elasticsearch
1

I know this is going to be simple but it's just not coming to me at all today.

GET /logs-*/_eql/search
{
  "query": """
    winlog where winlog.event_id == "4625" and stringContains(message, "The specified account's password has expired")
  """
}

Pretty simple really. How to search for an event ID with a particular message so I can set up an alert for it. Not seeing any of the fields in ECS so the examples are making me scratch my head.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.