> For the complete documentation index, see [llms.txt](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/zyberlab/08-wazuh-security-monitoring-basics/search-security-events.md).

# Search Security Events in Wazuh

Once more than one system is reporting to Wazuh, the next skill is learning how to narrow the data to the activity you actually need.

## Objective

Use simple filters and time windows to find relevant security events from `CLIENT01` and `DC01`.

## Start with a Question

Do not begin by scrolling through large amounts of data.

Start with a question such as:

* Did `CLIENT01` generate a failed logon?
* Was a new user created on `DC01`?
* Which process ran on `CLIENT01` at a specific time?
* Which endpoint generated a particular event ID?

A clear question makes the search easier.

## Use a Small Time Window

If you know approximately when the test occurred, reduce the dashboard time range to a few minutes around that activity.

This reduces noise and makes correlation easier.

## Useful Filters

Depending on the Wazuh version and data view, useful search fields may include:

* agent or host name
* Windows event ID
* Sysmon event ID
* username
* process name
* source IP address
* destination IP address
* rule ID
* rule description

The exact field names can vary, so inspect the event details in your current platform rather than memorizing one query format.

## Practice Search 1

Find a failed logon from `CLIENT01`.

Use:

```
Host or agent: CLIENT01
Windows Event ID: 4625
Time: Use the test window
```

Open one matching event and review the details.

## Practice Search 2

Find a user creation event from `DC01`.

Use:

```
Host or agent: DC01
Windows Event ID: 4720
Time: Use the test window
```

Compare the event with the activity you performed in Active Directory.

## Practice Search 3

Find a Sysmon process creation event from `CLIENT01`.

Use:

```
Host or agent: CLIENT01
Sysmon Event ID: 1
Process: Use a process you intentionally launched
```

## Search Method

A simple investigation search can follow this order:

```
Time
  ↓
Host
  ↓
Event Type
  ↓
User or Process
  ↓
Open Event Details
  ↓
Correlate Related Activity
```

## Verification

The lab is complete when you can:

* narrow events by time
* isolate one monitored host
* find a known Windows event
* find a known Sysmon event
* open an event and identify the main fields
* explain why searching from a question is better than browsing randomly

## Security Relevance

Security monitoring platforms can contain large amounts of data. Effective investigation depends on reducing that data to a focused set of events that answer a specific question.