A user within my organization was attempting to search for various windows events that indicated that somebody modified a user's acccess on a machine or domain controller. Originally the search being used was the following:
(EventCode > 630 AND EventCode < 640) OR EventCode = 641 OR (EventCode > 647 AND EventCode < 668) OR (EventCode > 4726 AND EventCode < 4736) OR EventCode = 4737 OR (EventCode > 4743 AND EventCode < 4763) OR EventCode = 4764 OR (EventCode > 4782 AND EventCode < 4793)
This was not returning the range of event codes properly.
I modified the search accordingly and came up with this:
index=windows* sourcetype="WinEventLog:Security" (EventCode>="630" AND EventCode<="640") OR EventCode="641" OR (EventCode>="647" AND EventCode<="668") OR (EventCode>="4726" AND EventCode<="4736") OR EventCode="4737" OR (EventCode>="4743" AND EventCode<="4763") OR EventCode="4764" OR (EventCode>="4782" AND EventCode<="4793")
Thought I would share for people.
-Regards
The following search returned more appropriate results for the user.
index=windows* sourcetype="WinEventLog:Security" (EventCode>="630" AND EventCode<="640") OR EventCode="641" OR (EventCode>="647" AND EventCode<="668") OR (EventCode>="4726" AND EventCode<="4736") OR EventCode="4737" OR (EventCode>="4743" AND EventCode<="4763") OR EventCode="4764" OR (EventCode>="4782" AND EventCode<="4793")
Sorry to hijack this thread.
Can someone please explain to me this string?
(EventCode>="630" AND EventCode<="640") OR EventCode="641" OR (EventCode>="647" AND EventCode<="668") OR (EventCode>="4726" AND EventCode<="4736") OR EventCode="4737" OR (EventCode>="4743" AND EventCode<="4763") OR EventCode="4764" OR (EventCode>="4782" AND EventCode<="4793")
I don't quite understand the logic behind the search string.
The following search returned more appropriate results for the user.
index=windows* sourcetype="WinEventLog:Security" (EventCode>="630" AND EventCode<="640") OR EventCode="641" OR (EventCode>="647" AND EventCode<="668") OR (EventCode>="4726" AND EventCode<="4736") OR EventCode="4737" OR (EventCode>="4743" AND EventCode<="4763") OR EventCode="4764" OR (EventCode>="4782" AND EventCode<="4793")