Microsoft Bug? Shift + Delete does not generate 4660 Event

By Tony Lee

If you have ever searched for anything along the lines of:  "How do I discover who deleted a file", you will probably find a dozen articles or more telling you to check for Windows Event ID 4660.

Some examples of excellent search results and resources can be found below (lmgtfy):

• https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4660
• https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4660
• https://eventlogxp.com/blog/tracking-down-who-removed-files/

Then the article will most likely mention that Event ID 4660 lacks the object name (son of a biscuit!) and you will need to map the event using the handle ID to Event ID 4656 or Event ID 4663 (with an Accesses=DELETE).  No problem, we've got this.  But what do you do if 4660 is not always created? This can happen!  (Dun... dun... duuuuunn.....)

Discovery

There are obviously multiple ways to delete a file such as the following:

• Delete key
• Right Click > Delete
• "del" from a command prompt
• Shift + Delete

Every single method above generates a 4660 (and 4663) except the last one, Shift + Delete, which happens to be my personal favorite way to to delete a file.  :-(  Delete it like you mean it...

Test Methodology

The discovery was frustrating and quite accidental. While deleting files, we noticed that no 4660 (or even 4663) logs were being created when we used Shift + Delete. In utter disbelief, we set up the following to prove our sanity:

• Enable all necessary auditing (lots of articles on this)
• Open Event Viewer > Windows Logs > Security > Filter Current Log > 4660 in the filter box
• Create 4 text files in which you will delete using the methods above
• Delete one file at a time and wait for Event Viewer to notify you of a new log
• Notice that Shift + Delete DOES NOT GENERATE A 4660!

Figure 1:  Test methodology shown above with Event Viewer, filters, notifications, and four files to delete

Conclusion

We all know that Windows logging is horrible, but this one takes the cake. It just seems scary that holding down shift while pressing delete will omit the log whose entry starts with: "An object was deleted." One possible work around is enabling the ever noisy Event ID 4656 and filtering that down--which still has its own pitfalls. Anyway, we hope this article helped debunk the myth that using Event ID 4660 for detecting file deletes is reliable (regardless of the name of the log entry).

Sample Logs

Some sample logs from our friend Randy Franklin Smith:

https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4663#examples

https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4660#examples

https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4656#examples

osquery - Part I - Local Agent Interaction

By Tony Lee and Matt Kemelhar

This series on osquery will take us on a journey from stand-alone agents, to managing multiple agents with Kolide, and then finally onto more advanced integrations, queries, and analysis.  Crawl, walk, run, right?  Ok, let's start crawling.

What is osquery?

osquery (https://osquery.io/) is an open source agent developed by Facebook that allows organizations to query endpoints of varying operating system using the same SQL syntax. These queries can be used for security, compliance, or DevOps as event-based, user-driven, or scheduled information gathering. Once the user learns the SQL syntax and osquery schema it will work the same across multiple operating systems [Windows, macOS, FreeBSD, Debian, RPM Linux, etc.] (for the most part).

For example, to list processes on Windows, it can be accomplished natively using the tasklist command.  For Linux/Unix this same task can be accomplished using the ps command.  If you are in osquery, regardless of the operating system, it can be accomplished with select * from processes;  While this may seem more cumbersome at first, there is an advantage of a single query and normalized output across all supported operating systems.

Installation

Installation is simple using one of the provided installers found here: 
https://osquery.io/downloads/official

There are installation instructions for each operating system in the docs section of the site:

https://osquery.readthedocs.io/en/stable/

For example, if you are looking for Windows installation instructions you would go here: 
https://osquery.readthedocs.io/en/stable/installation/install-windows/

For the majority of our article, it is simple, we will download the Windows .msi and double click it.

Interaction

Once osquery is installed (in this example on Windows), you can check to make sure the default installation path was created and populated.  In windows, it is:  C:\ProgramData\osquery


Then in a command prompt, check to see if the osqueryd agent is running using the following command:

C:\>sc.exe query osqueryd

SERVICE_NAME: osqueryd
        TYPE               : 10  WIN32_OWN_PROCESS
        STATE              : 4  RUNNING
                                (STOPPABLE, NOT_PAUSABLE, ACCEPTS_SHUTDOWN)
        WIN32_EXIT_CODE    : 0  (0x0)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0

        WAIT_HINT          : 0x0


If it is not running, try using:

C:\>sc.exe start osqueryd

Once running, we should be able to start the local client (osqueryi.exe) and run some queries.  By default it is located in:  c:\programdata\osquery\osqueryi.exe.  Run this from the command line and you will receive a new osquery prompt.  Try the following to ensure that the agent and client are working properly:

osquery> select * from uptime;

+------+-------+---------+---------+---------------+
| days | hours | minutes | seconds | total_seconds |
+------+-------+---------+---------+---------------+
| 21   | 10    | 17      | 34      | 1851454       |
+------+-------+---------+---------+---------------+

Here are a few useful commands to remember:

.help = help menu

.tables = list all the possible tables to query

.summary = version and configuration

.mode = change the output mode:  csv, column, line, list, pretty (default)

.exit = leave the program

Pro-tip:  The osqueryi client remembers command history so use the up and down arrows liberally.

Online Schema

We showed you a couple of queries so far, but how are you supposed to know what else exists?

1)  You can run .tables within the osqueryi client

2)  You can use the online schema (https://osquery.io/schema/) that contains every table, all columns, types, descriptions, and even displays the operating systems supported.

Figure 1:  The osquery schema - a great reference

Linux Example

For those with Linux, it is just as easy.  At the time of this writing here is the latest release:

Download:
wget https://pkg.osquery.io/deb/osquery_3.3.2_1.linux.amd64.deb


Install:
dpkg -i osquery_3.3.2_1.linux.amd64.deb


Usage:
root@ubuntu:~/osquery# osqueryi 
-- snip --
successfully completed!
Using a virtual database. Need help, type '.help'

osquery> select * from osquery_info;

Uninstall:

dpkg --remove osquery

Conclusion

Now that we understand the basics of osquery installation and local client usage, it should be very apparent that this will not scale to hundreds of thousands of hosts.  Thus, we need an osquery manager to make it enterprise ready.  However, we will leave this topic to the next article.

Troubleshooting Windows Account Lockouts with Splunk - Part III

By Tony Lee

Welcome to part III of the series dedicated to troubleshooting Windows account lockouts using Splunk. In this article we will give you a dashboard that we affectionately named Lockout Hunter. It combines the knowledge (and some dashboard panels) from both part I and part II of this series into a single interactive dashboard that allows users to drilldown on data without leaving the dashboard. You will notice in the screenshot below that the first row is event ID 4740 related panels. The far right two panels are hyperlink clickable and will cause the second row of event ID 4625 events to populate. This filter can be cleared by clicking the "Reset Filters" link or clicking on a different user or computer.

Figure 1:  Lockout Hunter Dashboard

Background

In part I (http://securitysynapse.com/2018/08/troubleshooting-windows-account-lockout-part-i.html) of the series, we highlighted and examined a 4740 event pulled from a domain controller. This 4740 event contained the following information:

• The domain controller that handled the authentication request and reported the lockout
• Domain name
• Account name
• The original host where the account attempted authentication

In part II (http://securitysynapse.com/2018/08/troubleshooting-windows-account-lockout-part-ii.html) of the series, we highlighted and examined a 4625 event (and Event ID 529 for EOL operating systems) pulled from workstations. The most important takeaways from this event are:

• Why the authentication attempt is failing
• The actual process (caller process name) failing authentication

When combined these two log sources are quite powerful.

Conclusion

We wanted to take lockout hunting up one more notch by releasing the lockout hunter dashboard. Our original intention was to help security practitioners find brute force attempts via account lockouts, however it ended up having a huge impact with ITOps. These dashboards have saved help desks quite a few hours in determining the root cause for account lockout tickets. We hope you find them useful too. Happy Splunking!

Dashboard Code

The following dashboard code relies on the index name of wineventlog.  If this is not your Windows event log index, just change it to suit your needs. Also, the past few cases we worked had either a Qualys on Nessus scanner generating some noise. We left the Qualys filter in but disabled it.  Feel free to also tweak that as needed.  Be sure to name the dashboard lockout_hunter so the "Reset Filters" link works properly.

<form>

  <label>Lockout Hunter - 4740 &amp; 4625</label>

  <description>Click on Top User or Top Caller_Computer_Name to pivot on the next row</description>

  <fieldset submitButton="true">

    <input type="time" searchWhenChanged="true" token="time">

      <label>Time Range</label>

      <default>

        <earliest>-4h@h</earliest>

        <latest>now</latest>

      </default>

    </input>

    <input type="text" token="user" searchWhenChanged="true">

      <label>User</label>

      <default>*</default>

    </input>

    <input type="text" token="src" searchWhenChanged="true">

      <label>Source</label>

      <default>*</default>

    </input>

    <input type="text" searchWhenChanged="true" token="wild">

      <label>Wildcard Search</label>

      <default>*</default>

    </input>

    <input type="radio" searchWhenChanged="true" token="notqualys">

      <label>Exclude Qualys</label>

      <choice value="NOT Qualys">Yes</choice>

      <choice value="*">No</choice>

      <default>*</default>

      <initialValue>*</initialValue>

    </input>

  </fieldset>

       <row>

     <panel>

       <html>

       <u1><h3>Event ID 4740 row - Click a user or host below to drill in on the second row</h3></u1>

       <a href="lockout_hunter?form.user=*&amp;form.src=*" style="margin-left:0px">Reset Filters</a>      

     </html>

     </panel>

   </row>

  <row>

    <panel>

      <table>

        <title>Top Domain</title>

        <search>

          <query>index=wineventlog $wild$ $notqualys$ source="WinEventLog:Security" EventCode="4740" | table _time, EventCode, Account_Domain, user, dvc, Caller_Computer_Name | top limit=0 Account_Domain</query>

          <earliest>$time.earliest$</earliest>

          <latest>$time.latest$</latest>

        </search>

        <option name="drilldown">none</option>

      </table>

    </panel>

    <panel>

      <table>

        <title>Top Reporting Server</title>

        <search>

          <query>index=wineventlog $wild$ $notqualys$ source="WinEventLog:Security" EventCode="4740" | table _time, EventCode, Account_Domain, user, dvc, Caller_Computer_Name | top limit=0 dvc</query>

          <earliest>$time.earliest$</earliest>

          <latest>$time.latest$</latest>

        </search>

        <option name="drilldown">none</option>

      </table>

    </panel>

    <panel>

      <table>

        <title>Top User (Click pivots to 4625)</title>

        <search>

          <query>index=wineventlog $wild$ $notqualys$ source="WinEventLog:Security" EventCode="4740" | table _time, EventCode, Account_Domain, user, dvc, Caller_Computer_Name | top limit=0 user</query>

          <earliest>$time.earliest$</earliest>

          <latest>$time.latest$</latest>

        </search>

        <option name="drilldown">cell</option>

        <drilldown>

          <set token="form.user">$click.value$</set>

        </drilldown>

      </table>

    </panel>

    <panel>

      <table>

        <title>Top Caller_Computer_Name (Click pivots to 4625)</title>

        <search>

          <query>index=wineventlog $wild$ $notqualys$ source="WinEventLog:Security" EventCode="4740" | table _time, EventCode, Account_Domain, user, dvc, Caller_Computer_Name | top limit=0 Caller_Computer_Name</query>

          <earliest>$time.earliest$</earliest>

          <latest>$time.latest$</latest>

        </search>

        <option name="drilldown">cell</option>

        <drilldown>

          <set token="form.src">$click.value$</set>

        </drilldown>

      </table>

    </panel>

  </row>

     <row>

     <panel>

       <html>

       <u1><h3>Event ID 4625 and 529 logs from the hosts</h3></u1>

     </html>

     </panel>

   </row>

  <row>

    <panel>

      <table>

        <title>Top Failure_Reason</title>

        <search>

          <query>index=wineventlog $wild$ user=$user$ src=$src$ $notqualys$ source="WinEventLog:Security" EventCode="4625" OR EventCode="529" | table _time, EventCode, Logon_Type, Status, Failure_Reason, Account_Domain, Account_Name, user, dvc, src, src_ip, Caller_Process_Name | top limit=0 Failure_Reason</query>

          <earliest>$time.earliest$</earliest>

          <latest>$time.latest$</latest>

        </search>

        <option name="drilldown">cell</option>

        <option name="refresh.display">progressbar</option>

      </table>

    </panel>

    <panel>

      <table>

        <title>Top Domain</title>

        <search>

          <query>index=wineventlog $wild$ user=$user$ src=$src$ $notqualys$ source="WinEventLog:Security" EventCode="4625" OR EventCode="529" | table _time, EventCode, Logon_Type, Status, Failure_Reason, Account_Domain, Account_Name, user, dvc, src, src_ip, Caller_Process_Name | top limit=0 Account_Domain</query>

          <earliest>$time.earliest$</earliest>

          <latest>$time.latest$</latest>

        </search>

        <option name="drilldown">cell</option>

        <option name="refresh.display">progressbar</option>

      </table>

    </panel>

    <panel>

      <table>

        <title>Top User</title>

        <search>

          <query>index=wineventlog $wild$ user=$user$ src=$src$ $notqualys$ source="WinEventLog:Security" EventCode="4625" OR EventCode="529" | table _time, EventCode, Logon_Type, Status, Failure_Reason, Account_Domain, Account_Name, user, dvc, src, src_ip, Caller_Process_Name | top limit=0 user</query>

          <earliest>$time.earliest$</earliest>

          <latest>$time.latest$</latest>

        </search>

        <option name="drilldown">cell</option>

        <option name="refresh.display">progressbar</option>

      </table>

    </panel>

    <panel>

      <table>

        <title>Top src</title>

        <search>

          <query>index=wineventlog $wild$ user=$user$ src=$src$ $notqualys$ source="WinEventLog:Security" EventCode="4625" OR EventCode="529" | table _time, EventCode, Logon_Type, Status, Failure_Reason, Account_Domain, Account_Name, user, dvc, src, src_ip, Caller_Process_Name | top limit=0 src</query>

          <earliest>$time.earliest$</earliest>

          <latest>$time.latest$</latest>

        </search>

        <option name="drilldown">cell</option>

        <option name="refresh.display">progressbar</option>

      </table>

    </panel>

  </row>

  <row>

    <panel>

      <table>

        <title>Top Process</title>

        <search>

          <query>index=wineventlog $wild$ user=$user$ src=$src$ $notqualys$ source="WinEventLog:Security" EventCode="4625" OR EventCode="529" | table _time, EventCode, Logon_Type, Status, Failure_Reason, Account_Domain, Account_Name, user, dvc, src, src_ip, Caller_Process_Name | top limit=0 Caller_Process_Name</query>

          <earliest>$time.earliest$</earliest>

          <latest>$time.latest$</latest>

        </search>

        <option name="drilldown">cell</option>

        <option name="refresh.display">progressbar</option>

      </table>

    </panel>

    <panel>

      <table>

        <title>Top Status</title>

        <search>

          <query>index=wineventlog $wild$ user=$user$ src=$src$ $notqualys$ source="WinEventLog:Security" EventCode="4625" OR EventCode="529" | table _time, EventCode, Logon_Type, Status, Failure_Reason, Account_Domain, Account_Name, user, dvc, src, src_ip, Caller_Process_Name | top limit=0 Status</query>

          <earliest>$time.earliest$</earliest>

          <latest>$time.latest$</latest>

        </search>

        <option name="drilldown">cell</option>

        <option name="refresh.display">progressbar</option>

      </table>

    </panel>

  </row>

  <row>

    <panel>

      <title>10 Day Glance of Total Lockouts (Independent of Dashboard Time Range Input) :</title>

      <chart>

        <title>Unique Lockouts per 2 minutes</title>

        <search>

          <query>index=wineventlog $wild$ $notqualys$ source="WinEventLog:Security" EventCode="4740" |bin _time span=2min|dedup user _time| timechart count span=1h</query>

          <earliest>-10d@d</earliest>

          <latest>now</latest>

          <sampleRatio>1</sampleRatio>

        </search>

        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>

        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>

        <option name="charting.axisLabelsY.majorUnit">25</option>

        <option name="charting.axisTitleX.visibility">visible</option>

        <option name="charting.axisTitleY.visibility">visible</option>

        <option name="charting.axisTitleY2.visibility">visible</option>

        <option name="charting.axisX.scale">linear</option>

        <option name="charting.axisY.maximumNumber">285</option>

        <option name="charting.axisY.scale">linear</option>

        <option name="charting.axisY2.enabled">0</option>

        <option name="charting.axisY2.scale">inherit</option>

        <option name="charting.chart">column</option>

        <option name="charting.chart.bubbleMaximumSize">50</option>

        <option name="charting.chart.bubbleMinimumSize">10</option>

        <option name="charting.chart.bubbleSizeBy">area</option>

        <option name="charting.chart.nullValueMode">gaps</option>

        <option name="charting.chart.showDataLabels">none</option>

        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>

        <option name="charting.chart.stackMode">default</option>

        <option name="charting.chart.style">shiny</option>

        <option name="charting.drilldown">none</option>

        <option name="charting.layout.splitSeries">0</option>

        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>

        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>

        <option name="charting.legend.placement">right</option>

        <option name="refresh.display">progressbar</option>

        <option name="trellis.enabled">0</option>

        <option name="trellis.scales.shared">1</option>

        <option name="trellis.size">medium</option>

      </chart>

    </panel>

  </row>

</form>

Troubleshooting Windows Account Lockouts with Splunk - Part II

By Tony Lee

Welcome to part II of the series dedicated to troubleshooting Windows account lockouts using Splunk. In part I (http://securitysynapse.com/2018/08/troubleshooting-windows-account-lockout-part-i.html) of the series, we highlighted and examined a 4740 event pulled from a domain controller. This 4740 event contained the following information:

• The domain controller that handled the authentication request and reported the lockout
• Domain name
• Account name
• The original host where the account attempted authentication

In this article we will look at a 4625 event from the originating host because it will contain further authentication details such as the reason for failure and the application that is attempting to authenticate. Our dashboard provided at the end of the article with also include searches for Event ID 529 to include Windows operating systems that are end of life (EOL).

Figure 1:  Combining Event ID 4740 and Event ID 4625 to gain more insight into account lockout

Examine the Problem

As we did with the 4740 event, we will now examine a fictional 4625 event and we will highlight and summarize the key points below. This fictional 4625 event was pulled from a host indicated by the 4740 event pulled from the domain controller.

LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4625
EventType=0
Type=Information
ComputerName=WIN-R9H5Y.MYFAKEDOMAIN.COM
TaskCategory=Logon
OpCode=Info
RecordNumber=267153
Keywords=Audit Failure
Message=An account failed to log on.

Subject:
Security ID: S-1-5-18
Account Name: WIN-R9H5Y$
Account Domain: MYFAKEDOMAIN
Logon ID: 0x3E7

Logon Type: 8

Account For Which Logon Failed:
Security ID: S-1-0-0
Account Name: John
Account Domain: MyFakeDomain.com

Failure Information:
Failure Reason: Unknown user name or bad password.
Status: 0xC000006D
Sub Status: 0xC000006A

Process Information:
Caller Process ID: 0x5aac
Caller Process Name: C:\Windows\System32\inetsrv\w3wp.exe

Network Information:
Workstation Name: WIN-R9H5Y
Source Network Address: 192.1.1.100
Source Port: 49770

Detailed Authentication Information:
Logon Process: Advapi  
Authentication Package: Negotiate
Transited Services: -
Package Name (NTLM only): -
Key Length: 0


The most important takeaways from this event are:

• Failure Reason:  In this case it was an unknown username or password.  We know the username is correct, so it must be a bad password
• Caller Process Name:  A quick Google search for w3wp.exe shows that it is most likely associated with an Exchange server running IIS.

After pulling a few more events, we see several more bad passwords and then the eventual lockout. Common causes for account lockouts indicated by this process are mobile devices (phone or tablet) that contain stale credentials. The mobile device continues to attempt to authenticate until it locks out the account. Mystery solved!

Conclusion

Even though we presented fictional event logs, this example is based on real situations. Fortunately we had the 4740 events from the domain controllers and we were collecting the 4625 logs from the rest of the servers (and some workstations). It would be very difficult and time consuming to perform this sort of correlation without a central point of aggregation such as Splunk. Even if you were to do this manually for one or two instances, you would not want to do it for the entire enterprise. To make your life easier, we are including dashboard code in the section below to display the 4625 events. We eventually added some workflow integration between the 4740 dashboard provided in the previous article and the 4625 dashboard below, but we will leave that exercise up to the reader. Have fun and happy Splunking.

Dashboard Code

The following dashboard code relies on the index name of wineventlog.  If this is not your Windows event log index, just change it to suit your needs. Also, the past few cases we worked had either a Qualys on Nessus scanner generating some noise. We left the Qualys filter in but disabled it.  Feel free to also tweak that as needed.

<form>
  <label>Auth Examination - 4625</label>
  <description>Event ID 4625 or 529</description>
  <fieldset submitButton="true">
    <input type="time" token="time" searchWhenChanged="true">
      <label>Time Range</label>
      <default>
        <earliest>-4h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="text" token="wild" searchWhenChanged="true">
      <label>Wildcard Search</label>
      <default>*</default>
    </input>
    <input type="radio" token="notqualys" searchWhenChanged="true">
      <label>Exclude Qualys</label>
      <choice value="NOT Qualys">Yes</choice>
      <choice value="*">No</choice>
      <default>*</default>
      <initialValue>*</initialValue>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <title>Top Failure_Reason</title>
        <search>
          <query>index=wineventlog $wild$ $notqualys$ source="WinEventLog:Security" EventCode="4625" OR EventCode="529" | table _time, EventCode, Logon_Type, Status, Failure_Reason, Account_Domain, Account_Name, user, dvc, src, src_ip, Caller_Process_Name | top limit=0 Failure_Reason</query>
          <earliest>$time.earliest$</earliest>
          <latest>$time.latest$</latest>
        </search>
        <option name="drilldown">cell</option>
      </table>
    </panel>
    <panel>
      <table>
        <title>Top Domain</title>
        <search>
          <query>index=wineventlog $wild$ $notqualys$ source="WinEventLog:Security" EventCode="4625" OR EventCode="529" | table _time, EventCode, Logon_Type, Status, Failure_Reason, Account_Domain, Account_Name, user, dvc, src, src_ip, Caller_Process_Name | top limit=0 Account_Domain</query>
          <earliest>$time.earliest$</earliest>
          <latest>$time.latest$</latest>
        </search>
        <option name="drilldown">cell</option>
      </table>
    </panel>
    <panel>
      <table>
        <title>Top User</title>
        <search>
          <query>index=wineventlog $wild$ $notqualys$ source="WinEventLog:Security" EventCode="4625" OR EventCode="529" | table _time, EventCode, Logon_Type, Status, Failure_Reason, Account_Domain, Account_Name, user, dvc, src, src_ip, Caller_Process_Name | top limit=0 user</query>
          <earliest>$time.earliest$</earliest>
          <latest>$time.latest$</latest>
        </search>
        <option name="drilldown">cell</option>
      </table>
    </panel>
    <panel>
      <table>
        <title>Top src</title>
        <search>
          <query>index=wineventlog $wild$ $notqualys$ source="WinEventLog:Security" EventCode="4625" OR EventCode="529" | table _time, EventCode, Logon_Type, Status, Failure_Reason, Account_Domain, Account_Name, user, dvc, src, src_ip, Caller_Process_Name | top limit=0 src</query>
          <earliest>$time.earliest$</earliest>
          <latest>$time.latest$</latest>
        </search>
        <option name="drilldown">cell</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <table>
        <title>Top Process</title>
        <search>
          <query>index=wineventlog $wild$ $notqualys$ source="WinEventLog:Security" EventCode="4625" OR EventCode="529" | table _time, EventCode, Logon_Type, Status, Failure_Reason, Account_Domain, Account_Name, user, dvc, src, src_ip, Caller_Process_Name | top limit=0 Caller_Process_Name</query>
          <earliest>$time.earliest$</earliest>
          <latest>$time.latest$</latest>
        </search>
        <option name="drilldown">cell</option>
      </table>
    </panel>
    <panel>
      <table>
        <title>Top Status</title>
        <search>
          <query>index=wineventlog $wild$ $notqualys$ source="WinEventLog:Security" EventCode="4625" OR EventCode="529" | table _time, EventCode, Logon_Type, Status, Failure_Reason, Account_Domain, Account_Name, user, dvc, src, src_ip, Caller_Process_Name | top limit=0 Status</query>
          <earliest>$time.earliest$</earliest>
          <latest>$time.latest$</latest>
        </search>
        <option name="drilldown">cell</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>Timechart by Account_Name</title>
      <chart>
        <search>
          <query>index=wineventlog $wild$ $notqualys$ source="WinEventLog:Security" EventCode="4625" OR EventCode="529"| timechart count by user</query>
          <earliest>$time.earliest$</earliest>
          <latest>$time.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">area</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
      </chart>
    </panel>
    <panel>
      <title>Timechart by reporting host</title>
      <chart>
        <search>
          <query>index=wineventlog $wild$ $notqualys$ source="WinEventLog:Security" EventCode="4625" OR EventCode="529"| timechart count by dvc</query>
          <earliest>$time.earliest$</earliest>
          <latest>$time.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">area</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <title>Timechart by Account_Domain</title>
      <chart>
        <search>
          <query>index=wineventlog $wild$ $notqualys$ source="WinEventLog:Security" EventCode="4625" OR EventCode="529"| timechart count by Account_Domain</query>
          <earliest>$time.earliest$</earliest>
          <latest>$time.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">area</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
      </chart>
    </panel>
    <panel>
      <title>Timechart by src</title>
      <chart>
        <search>
          <query>index=wineventlog $wild$ $notqualys$ source="WinEventLog:Security" EventCode="4625" OR EventCode="529"| timechart count by src</query>
          <earliest>$time.earliest$</earliest>
          <latest>$time.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">area</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <title>Details</title>
      <table>
        <search>
          <query>index=wineventlog $wild$ $notqualys$ source="WinEventLog:Security" EventCode="4625" OR EventCode="529" | table _time, EventCode, Logon_Type, Status, Failure_Reason, Account_Domain, Account_Name, user, dvc, src, src_ip, Caller_Process_Name</query>
          <earliest>$time.earliest$</earliest>
          <latest>$time.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="drilldown">cell</option>
      </table>
    </panel>
  </row>
</form>