An analyst must reconstruct a clerk session: civic VPN logon, then…

Question

An analyst must reconstruct a clerk session: civic VPN logon, then file-share access, then rare egress. The events share user and occur within a bounded pause. Which command should glue them into one session?

Accepted Answer

transaction grouped by user with maxpause and maxspan to bind the related civic events. — A clerk's night is a string of beads: VPN, share, weird egress. transaction puts those beads on one string when they share a user and stay inside the time gap. That is the session picture, not three orphaned rows.

Answer

tstats summariesonly=true on Authentication only, which cannot span those other sourcetypes as a session.

Answer

eval alone to concatenate the three raw raw strings into one field.

Answer

makeresults to invent a session row without reading the clerk's events.

An analyst must reconstruct a clerk session: civic VPN logon, then file-share access, then rare egress. The events share user and occur within a bounded pause. Which command should glue them into one session?

Short Explanation

Full Explanation