Copy and Paste into SIEM Search Bar - (replace the XXXX values)

SELECT new_logs.uuid, new_logs.organization_id, new_logs.host_hostname AS host_hostname, new_logs.ecs_fields['winlog.event_data.SubjectUserName'] AS ecs_winlog_event_data_SubjectUserName, new_logs.ecs_fields['winlog.event_data.TaskName'] AS ecs_winlog_event_data_TaskName, new_logs.message FROM new_logs AS logs WHERE new_logs.organization_id = XXXXX AND new_logs.account_id = XXXX AND new_logs.uuid >= 'XXXXX-XXXXX-XXXXXX' AND new_logs.uuid < 'XXXXXXXX-XXXXXX-XXXXXXX' AND new_logs.event_provider = 'Microsoft-Windows-Security-Auditing' AND new_logs.event_code = 4698 AND lower(new_logs.host_hostname) = 'XXX-XXXX ORDER BY new_logs.uuid DESC LIMIT 100