Hi guys,

I wrote a query that monitors for abnormal computer names joining my organization network. I had some success with those queries, but they still returns some false positives for me. How can I improve it?

| process eval("is_abnormal_computer_name = (machine != like('Computer_Name') AND machine != like('Computer_Name') AND machine != like('Computer_Name') AND machine != like('Computer_Name'))")

| process eval("is_abnormal_computer_name !=  like(machine, '^(name|name|name|name).*')")

I want the query to returns the computer names that are abnormal.