I am currently working on one use case for winlogbeat data. Usecase is as follows:
Use Case: Trigger alert if the user account is deleted within one hour after creation.
Trying to understand the EQL syntax for the above use case. Using winlog event id: 4720 and 4726 for account creation and deletion.
Help me to fine-tune the above query.