Windows Event Logs report for one employee

[jayson091]

I am super new to SO but I have had it runnning for a few months now and I am collecting windows logs from 3 DC's and and few workstations using the elastic fleet with SO agent. I can run a query and get the event logs for log on/logoff/lock etc. My question is how do easily run a query to export to a report? I have watched all videos and read everything, but it is just standing out to me.

Our log file max on Windows DC is 4GB so I am missing about 30 days of logs I would like to add to a report. This is where our SIEM should be able to come into play. I have SO and CheckMK right now collecting in the testing. I am green on both but at least I know the data is probably there.

If I run the hunt against this I am getting the information I need and the tags look correct, I think??

[
"elastic-agent",
"input-rsm-so",
"beats_input_codec_plain_applied",
"events.file"

Do I just run the hunt for 52 days and somehow export the report? My hunt is probably something like event id 4625,4624,434,4647,4800,4801 with an employee user id?

Or do I use Kibana? Here is the output of that:

event.code
4625
@timestamp
Feb 27, 2024 @ 08:22:01.962
@Version
1
agent.ephemeral_id
1c520e09-d5cc-4c70-a856-c6623986ef17
agent.id
253e4cb9-d5d1-453e-b06b-553a9d2ac6b4
agent.name
DC01
agent.type
filebeat
agent.version
8.10.4
data_stream.dataset
system.security
data_stream.namespace
default
data_stream.type
logs
dataset_tag_temp
security
ecs.version
8.0.0
elastic_agent.id
253e4cb9-d5d1-453e-b06b-553a9d2ac6b4
elastic_agent.snapshot
false
elastic_agent.version
8.10.4
error.message
failed in Fleet agent final_pipeline: Text '2024-02-27T14:22:03.769Z' could not be parsed at index 20
event.action
logon-failed
event.agent_id_status
auth_metadata_missing
event.category
authentication
event.created
Feb 27, 2024

Kibana doesnt look like I am able to query the user though. Which is strange because if I use event.code:4625 AND user.name:employee name is doesnt work but if I run user.name:employee it comes back with all kinds of events.

[jayson091]

I ended up figuring this out. This is key before you get all of the stuff you need from AD.

https://techcommunity.microsoft.com/t5/windows-server-for-it-pro/active-directory-hunting-set-up-advanced-monitoring-with-sysmon/m-p/3977120

Once we did that we can see it all now in kibana.