windows event checking

Follow

Francis Devaraj

• December 16, 2020 03:17

how to check windows event log for 4720 account creation history in sumo, please share script to check

0

• 

  Shobhit Garg

  • December 21, 2020 08:05

  Hi Francis,

  If you have configured the windows event source as per the below docs

  https://help.sumologic.com/03Send-Data/Sources/01Sources-for-Installed-Collectors/Local-Windows-Event-Log-Source

  Now 4720 comes under SECURITY logs, so if you are collecting it then you can write a query like and select the time-range of your choice.

  _collector=<name of collector> and _source=<source_name> and "4720"

  Hope this helps.

  Regards,

  Shobhit

  0

  Comment actions Permalink

Please sign in to leave a comment.