✄𐘗
text code block:
✄𐘗from logs-windows.forwarded*, logs-system.security* metadata _id, _version, _index
| where host.os.type == "windows" and event.code == "4719" and
  // The description field is multi-valued when success and failure change together
  (
    MV_CONTAINS(winlog.event_data.AuditPolicyChangesDescription, "Success removed") or
    MV_CONTAINS(winlog.event_data.AuditPolicyChangesDescription, "Success Added")
  ) and
  winlog.event_data.SubCategory in (
    "Logon",
    "Audit Policy Change",
    "Process Creation",
    "Other System Events",
    "Security Group Management",
    "User Account Management"
  )

// Latest "Success Added" for this computer and subcategory in the lookback.
| eval Esql.is_restore = MV_CONTAINS(winlog.event_data.AuditPolicyChangesDescription, "Success Added")
| inline stats
    Esql.restore_at = MAX(@timestamp) where Esql.is_restore
  by winlog.computer_name, winlog.event_data.SubCategory

// Keep a removal that was ingested at least 5 minutes ago and has no later restore.
// The same timestamp counts as restored.
| where MV_CONTAINS(winlog.event_data.AuditPolicyChangesDescription, "Success removed") and
  event.ingested < NOW() - 5m and
  (
    Esql.restore_at is null or
    Esql.restore_at < @timestamp
  )
| keep *