Search event X that happend after event Y

[maor_levi]

I have an index that contain security evevts from endpoints.
In the index there is event 4688 (process creation) and 4689 (process termination).
There are the fields : event_id, process_name.
I want to find all of the 4689 events that occurred at the 20 seconds after the creation of event 4688 with process_name :"XXXX" on the same computer.

Is it possible to do this?

[jbudz (Jon Budzenski)]

Depending on your kibana version, view surrounding documents may be able to help. You can find it by expanding a document on the discover tab:

. You can make sure you only get your process_name events by clicking on the magnifying class shown in the table next to your process_name field

It goes by document count instead of time range. If you need exactly 20 seconds you'll probably have to update the date picker exactly.

[maor_levi]

But I want to find all of them, not only a specific one.