EQL Query for User account creation and deletion

Elastic Stack Elasticsearch
1

I am currently working on one use case for winlogbeat data. Usecase is as follows:

Use Case: Trigger alert if the user account is deleted within one hour after creation.

Trying to understand the EQL syntax for the above use case. Using winlog event id: 4720 and 4726 for account creation and deletion.

Help me to fine-tune the above query.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.