https://community.splunk.com/t5/Security/How-to-correlate-two-rules-alert-into-a-third/m-p/687106#M17850 <P>I understand. You can make a little progress using the strategy of pulling alerts that are triggered. My research is as follows:<BR /><BR /></P><LI-CODE lang="markup">index=_audit action="alert_fired" ss_app=search ss_name="alert 1" OR ss_name="alert 2" | rename ss_name AS title | stats count by title, ss_app, _time | sort -_time</LI-CODE><P>In this research I can bring up the two alerts that I want to combine. Is it possible to get certain fields from these two alerts?</P><P>In this case, I want to get the user. I can only generate the alert if the user is the same, the problem is that there are two different log providers and therefore, the field that has the user value has different names.</P> Thu, 09 May 2024 23:08:41 GMT matheusvortex 2024-05-09T23:08:41Z https://community.splunk.com/t5/Security/How-to-correlate-two-rules-alert-into-a-third/m-p/687097#M17848 <P>Hello everyone,</P><P>How can I correlate two alerts into a third one?</P><P>For instance:<BR />I have alert 1 and alert 2 both with medium severity.<BR />I need the following validation in alert 3:<BR />If, after 6 hours since alert 1 was triggered, alert 2 is triggered as well, generate alert 3 with high severity.</P> Thu, 09 May 2024 21:44:08 GMT https://community.splunk.com/t5/Security/How-to-correlate-two-rules-alert-into-a-third/m-p/687097#M17848 matheusvortex 2024-05-09T21:44:08Z https://community.splunk.com/t5/Security/How-to-correlate-two-rules-alert-into-a-third/m-p/687104#M17849 <P>Alerts are based on results of a search - for an alert to be triggered based on two conditions, your search needs to find both conditions.</P> Thu, 09 May 2024 22:08:04 GMT https://community.splunk.com/t5/Security/How-to-correlate-two-rules-alert-into-a-third/m-p/687104#M17849 ITWhisperer 2024-05-09T22:08:04Z https://community.splunk.com/t5/Security/How-to-correlate-two-rules-alert-into-a-third/m-p/687106#M17850 <P>I understand. You can make a little progress using the strategy of pulling alerts that are triggered. My research is as follows:<BR /><BR /></P><LI-CODE lang="markup">index=_audit action="alert_fired" ss_app=search ss_name="alert 1" OR ss_name="alert 2" | rename ss_name AS title | stats count by title, ss_app, _time | sort -_time</LI-CODE><P>In this research I can bring up the two alerts that I want to combine. Is it possible to get certain fields from these two alerts?</P><P>In this case, I want to get the user. I can only generate the alert if the user is the same, the problem is that there are two different log providers and therefore, the field that has the user value has different names.</P> Thu, 09 May 2024 23:08:41 GMT https://community.splunk.com/t5/Security/How-to-correlate-two-rules-alert-into-a-third/m-p/687106#M17850 matheusvortex 2024-05-09T23:08:41Z https://community.splunk.com/t5/Security/How-to-correlate-two-rules-alert-into-a-third/m-p/687107#M17851 <P><SPAN>I understand. I managed to make a little progress using the strategy of pulling through triggered alerts. My research is as follows:******</SPAN></P> Thu, 09 May 2024 23:09:43 GMT https://community.splunk.com/t5/Security/How-to-correlate-two-rules-alert-into-a-third/m-p/687107#M17851 matheusvortex 2024-05-09T23:09:43Z https://community.splunk.com/t5/Security/How-to-correlate-two-rules-alert-into-a-third/m-p/687131#M17852 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/267774">@matheusvortex</a>&nbsp;,</P><P>you could write the results of the two searches in one summary index (called e.g. Notables), adding in each alert all the fields you need and then execute the third alert on the summary index displaying the fields you need.</P><P>Ciao.</P><P>Giuseppe</P><P>This is the approach of Enterprise Security.</P> Fri, 10 May 2024 05:43:27 GMT https://community.splunk.com/t5/Security/How-to-correlate-two-rules-alert-into-a-third/m-p/687131#M17852 gcusello 2024-05-10T05:43:27Z https://community.splunk.com/t5/Security/How-to-correlate-two-rules-alert-into-a-third/m-p/687349#M17858 <P>Could you support me, what would this research look like?</P> Mon, 13 May 2024 15:02:41 GMT https://community.splunk.com/t5/Security/How-to-correlate-two-rules-alert-into-a-third/m-p/687349#M17858 matheusvortex 2024-05-13T15:02:41Z