//CW - FILE UPLOAD VIA RBI HUNT. PLEASE USE A MAXIMUM OF 7 DAYS TIMEFRAME.
ComputerName!=NAMING.CONVENTION*
| #event_simpleName= LnkFileWritten
| TargetFileName = /\\Device\\HarddiskVolume2\\Users\\.{1,20}\\AppData\\Roaming\\Microsoft\\Windows\\Recent.*/i
| time1:=@timestamp
| regex(field="TargetFileName", regex="^(?<temp1>.*).{4}$")
| format("%s, %s, %s", field=[ComputerName, FileIdentifier, temp1], as =identityString)
| join({#event_simpleName!=LnkFileWritten
| TargetFileName = /\\Device\\HarddiskVolume2\\Users\\.{1,20}\\AppData\\Roaming\\Microsoft\\Windows\\Recent.*/i
| #event_simpleName= /(NewExecutableWritten|.*FileWritten)/
| time2:=@timestamp
| regex(field="TargetFileName", regex="^(?<temp1>.*).{4}$")
| format("%s, %s, %s", field=[ComputerName, FileIdentifier, temp1], as =identityString)}, mode=inner, field=identityString, include=time2)
| eval(diff=time2 - time1) // Calculate the difference in milliseconds
| diff< 30000  AND diff>-30000 //where difference is less than 30 seconds
| format("%s.wales.domain:3389",field=ComputerName, as=urlHigher)
| URL:=lower(urlHigher)
| join(
{#repo="WEB_PROXY_REPO"
| #type="syslog"
| COMP_NAME="RBI_*"
| URL= "*.wales.domain:3389"
| time3:=@timestamp},mode=inner, field=URL, include=[COMP_NAME, time3, USER])
| eval(diff2=time3-time1)
| diff<100000 AND diff>-100000
| table([@timestamp, TargetFileName, USER, ComputerName, COMP_NAME])