u/Boring_Pipe_5449

Hi there, thanks for reading!

i am trying to bring together two of our logs NGSIEM.

1. Falcon logs to see which user was logged into a client at a given time

2. Our firewall logs that only show source and destination ip but no user.

Here is my try:

defineTable(query={
UserName!="*$" and UserName!=""
|cidr("LocalIP", subnet=["MYlocalSubnets"])
}, include=[aid,UserName, LocalIP], name="Computers")
| u/collect.host="CollectingHostOfFirewallLogs"
| cidr("source.ip", subnet=["RelevantSubnets")
| in(field="destination.port", values=[Ports i am looking for])
| match(file="Computers", field=[LocalIP])
|groupBy([source.ip, destination.ip,destination.port, Vendor.rule, UserName])
|sort(destination.ip)

But the bigger my search window is, the worse by result gets as the Computers table will be static only and not having any time component in it.

Is there a way to get around this?

Thank you!

Following this: Multiple alerts for missing Microsoft Defender Core Service (MDCoreSvc) : r/sysadmin i see the service is remove again tonight after installing KB5094122 on Server 2016.

Anyone seeing the the same? I did not find anything official in the Microsoft notes and the original post is already 8 months old.