Search event X that happend after event Y


(Maor Levi) #1

I have an index that contain security evevts from endpoints.
In the index there is event 4688 (process creation) and 4689 (process termination).
There are the fields : event_id, process_name.
I want to find all of the 4689 events that occurred at the 20 seconds after the creation of event 4688 with process_name :"XXXX" on the same computer.

Is it possible to do this?


(Jon Budzenski) #2

Depending on your kibana version, view surrounding documents may be able to help. You can find it by expanding a document on the discover tab:

. You can make sure you only get your process_name events by clicking on the magnifying class shown in the table next to your process_name field

It goes by document count instead of time range. If you need exactly 20 seconds you'll probably have to update the date picker exactly.


(Maor Levi) #3

But I want to find all of them, not only a specific one.


(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.