Help with my Query :)

Can anyone advise where im going wrong with my query ?

I am trying to achieve the following:
Generate an Alert whenever event.code 4648 is seen - with the only exception being to not alert if the winlog.event_data.SubjectUserName matches the winlog.event_data.TargetUsername field.

I have tried several variations of the following query, but i am still getting alerts whereby the Subject and Target user match for that windows event:

event.code:"4648" and (not winlog.event_data.SubjectUserName:* or not winlog.event_data.TargetUserName:* or not winlog.event_data.SubjectUserName == winlog.event_data.TargetUserName)

Appreciate any help, folks.

Thanks

Hi,

The not operator is negating the entire condition, which is not what you want.

Try this:

event.code:"4648" AND NOT (winlog.event_data.SubjectUserName: * AND winlog.event_data.TargetUserName: * AND winlog.event_data.SubjectUserName == winlog.event_data.TargetUserName)

Regards

Hi yago82, thanks for your suggestion; i see what you mean.

Unfortunately im still having no luck with your suggested query :frowning:
I have double and triple checked that ive got your query right, and also that the field values are the same in the activity that i want to exclude (subject and target user).

I may hav to explore other avenues of filtering this activity, annoyingly.

Really appreciate your help tho.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.