topic Re: How to trigger alerts on the count of the value of a custom field in All Apps and Add-ons

How to trigger alerts on the count of the value of a custom field?

olawalePS — Tue, 08 Nov 2022 16:00:58 GMT

I am trying to create an alert for multiple failed logins but my query doesn't seem to work.

The alert is detailed in the image attached, and the query is:

index="authenticate" eventType="user.session.start" outcome.result="FAILURE"
| stats count by actor.alternateId

Please help correct the query.

Re: How to trigger alerts on the count of the value of a custom field

gcusello — Tue, 08 Nov 2022 08:57:38 GMT

Hi @olawalePS,

insert the condition in the search:

index="authenticate" eventType="user.session.start" outcome.result="FAILURE" | stats count by actor.alternateId | where count>3

and trigger the alert when results>0

then I don't like to have dots in a field so I prefer:

index="authenticate" eventType="user.session.start" outcome.result="FAILURE" | rename actor.alternateId AS alternateId | stats count by alternateId | where count>3

Ciao.

Giuseppe

Re: How to trigger alerts on the count of the value of a custom field

olawalePS — Wed, 09 Nov 2022 11:16:07 GMT

I modified the search but it still did not trigger an alert. is the cron job schedule configured correctly?

I attached the screenshot of the config

Re: How to trigger alerts on the count of the value of a custom field

gcusello — Wed, 09 Nov 2022 11:43:14 GMT

Hi @olawalePS,

your search is schedule to run one time a week (Monday at 6:00) on the last 10 minutes, is it correct?

Ciao.

Giuseppe

Re: How to trigger alerts on the count of the value of a custom field

olawalePS — Wed, 09 Nov 2022 12:19:41 GMT

@gcusello No, I want it to run every 10 minutes.

Re: How to trigger alerts on the count of the value of a custom field

olawalePS — Wed, 09 Nov 2022 12:34:34 GMT

@gcusello I have corrected the cron expression. Thanks for helping to point it out