Trying to exclude accounts with $

Graylog Central (peer support)
,
1

Hello GL friends!!

So here’s a hopefully simple query question.

I have a windows event, 4624 to be specific tracking successful windows logons. In my search I am trying to exclude the computer accounts that show up as $ names so that all I get are the actual users that logged in.

Here’s the search I’m using:

EventID:4624 AND LogonType:3 AND NOT (WorkstationName:-) AND NOT (TargetUserName:HealthMailbox* OR TargetUserName:“ANONYMOUS LOGON”)

And I get these accounts as a sample result:

image

I’m trying to exclude the accounts with a $ at the end. How can I do that in my search?

Thanks

TP

2

I am pretty new at regex but this worked for me:

NOT winlogbeat_event_data_TargetUserName:/.*$/

3

That worked!! Thanks

TP

4

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.