retrieve RDP informations

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

retrieve RDP informations

L0 Member

Hello and sorry for my bad english,

 

I want to retrieve informations about RDP connection to computers. 

When computer A connect to computer B with RDP, on computer B (destination) windows log this event :
Event Security with ID 4624 et logon type 10

How by query builder retrieve this information on all computers ?

thanks a lot

1 accepted solution

Accepted Solutions

I create found base on other topic on forum, the script is :

 

dataset = xdr_data
| filter event_type = WINDOWS_EVENT_LOG AND action_evtlog_event_id = 4624
| alter Logon_Type = arrayindex(regextract(action_evtlog_message, "Logon Type:.*?(\d+)\r\n"),0), User_Name = arrayindex(regextract(action_evtlog_message,"New Logon:\r\n.*\r\n.*?Account Name:.*?(\w.*?)\r\n"),0), Source_IP = arrayindex(regextract(action_evtlog_message, "Source Network Address:.*?(\d+\.\d+\.\d+\.\d+)\r\n"),0), HOST_Name = arrayindex(regextract(action_evtlog_message, "Workstation Name:.*?(\w.*)\r\n"),0)
| filter Logon_Type  = "10"
| fields agent_hostname, User_name, Logon_Type, Source_IP  

View solution in original post

2 REPLIES 2

L5 Sessionator

Hello @LECORRE ,

Thank you for writing to live community.

 

You can use below query as a sample and modify it as per your requirement:

preset = xdr_event_log
| filter action_evtlog_event_id = 4624

 

Hope this helps!

Please mark the response as "Accept as Solution" if it answers your query.

Ashutosh Patil

I create found base on other topic on forum, the script is :

 

dataset = xdr_data
| filter event_type = WINDOWS_EVENT_LOG AND action_evtlog_event_id = 4624
| alter Logon_Type = arrayindex(regextract(action_evtlog_message, "Logon Type:.*?(\d+)\r\n"),0), User_Name = arrayindex(regextract(action_evtlog_message,"New Logon:\r\n.*\r\n.*?Account Name:.*?(\w.*?)\r\n"),0), Source_IP = arrayindex(regextract(action_evtlog_message, "Source Network Address:.*?(\d+\.\d+\.\d+\.\d+)\r\n"),0), HOST_Name = arrayindex(regextract(action_evtlog_message, "Workstation Name:.*?(\w.*)\r\n"),0)
| filter Logon_Type  = "10"
| fields agent_hostname, User_name, Logon_Type, Source_IP  
  • 1 accepted solution
  • 1297 Views
  • 2 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!