Splunk Search

Hello, I need to build a alert that fires on the presents of the two Windows Event codes I.E. EventCode=4663 and EventCode=4776, any suggestions

bluemarvel
Path Finder

In order for the alert to work, both Eventcodes have to be activated.

query | search EventCode=4663 OR EventCode=4776 | table _time,EventCode,Message,

Tags (1)
0 Karma
1 Solution

nickhills
Ultra Champion

I am making some assumptions:
1.) you expect the events to happen on the same host, and in a specific order (4663 followed by 4776)
2.) you expect the events to occur within a specified period of time (300 seconds)
3.) you don't care about other events which may have occurred in the meantime.

In which case the following should give you a result each time the above occurs:

( EventCode=4663 OR EventCode=4776) | transaction host maxspan=300s startswith="EventCode=4663" endswith="EventCode=4776"|table _time,host,EventCode,Message
If my comment helps, please give it a thumbs up!

View solution in original post

nickhills
Ultra Champion

I am making some assumptions:
1.) you expect the events to happen on the same host, and in a specific order (4663 followed by 4776)
2.) you expect the events to occur within a specified period of time (300 seconds)
3.) you don't care about other events which may have occurred in the meantime.

In which case the following should give you a result each time the above occurs:

( EventCode=4663 OR EventCode=4776) | transaction host maxspan=300s startswith="EventCode=4663" endswith="EventCode=4776"|table _time,host,EventCode,Message
If my comment helps, please give it a thumbs up!

bluemarvel
Path Finder

it does thank you

0 Karma

naidusadanala
Communicator

Generally in windows logs for every event there will be one EventCode per event .

unable to understand the criteria "For triggerring the alert both event codes have to be activated?"

Per my understanding , does the alert needs to trigger if both the event codes occur with time difference ?

0 Karma

bluemarvel
Path Finder

no, the suggestion that was provided will suffice, thank you

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...