Okay so im having a hard time solving this puzzle. Tried almost everything and i cant really solve it by myself, any ideas?
So i have 2 event ID's:
winlog.event_id: 4624
winlog.event_id: 4672
What i want to do is i want to exclude 3-4 or more UserSID Usernames etc. and i only want to specify every event ID's. So for example which applies to 4624 is only applies to 4624. Which applies to 4672 only applies to 4672. etc.
The code i have right now is this:
I think i probably have 'and', 'or' problem. Not sure tho.
Note that i might want to add ore event ID's in the future.
Im also curious, so if i want to add more event id, this will be just an example but:
Please note that event id 9999 is just an example.
But every event when its ends, i need to add "- and:" and then the new event id.
Its really confusing at first to be honest but i gotcha.
Edit: After i tested i actually dont get event id 4624. So for example i still want to get every event id 4624 except those one which has TargetUserame: 'System' in this case. So it has System? Drop the event, let every other event pass within 4624.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.