Share, discover, and version LogScale queries, parsers, dashboards, and how-tos with the community.
Recently shared by the community.
#windows.Channel = * | groupBy([@collect.host, #windows.Channel])
An overview of Windows systems grouped by Event Log channel. Used in the how-to: [[howto:Install LogScale Collector on Windows]]
@sebastian · 3.8.2026
in(field="#windows.EventID", values=[4732,4728,4756,4729,4733,4757]) | day := formatTime(format="%Y-%m-%d", field=@timestamp, timezone="Europe/Berlin") | rename(field="windows.EventData.TargetUserName", as="group") | groupBy([day, group], function=count())
Aggregate Active Directory group membership additions and removals into a daily count by group for compliance reporting and anomaly baselining. Keep the timezone aligned with your investigation queries. Source: the blog article “5 LogScale queries to audit Active Directory group changes” — https://it-selig.de/blog/logscale-queries-ad-group-changes
@sebastian · 2.8.2026
in(field="#windows.EventID", values=[4732,4728,4756,4729,4733,4757]) | windows.EventData.SubjectUserName=/^(svc_|sa_|srv_)/i // only show during office hours, when automation should be idle
Find group membership changes made by service accounts during the period when their automation should be idle. Adapt the account-name regex, office-hour window, and IANA timezone to match your conventions. Source: the blog article “5 LogScale queries to audit Active Directory group changes” — https://it-selig.de/blog/logscale-queries-ad-group-changes
@sebastian · 2.8.2026
Recently shared ingest parsers.
No parsers published yet.
Upload parserRecently shared dashboard definitions.
No dashboards published yet.
Upload dashboardRecently shared guides and walkthroughs.