topic Re: Trigger alert when 1 user deletes more than 5 files in Getting Data In

Trigger alert when 1 user deletes more than 5 files

mishmeret — Wed, 17 Nov 2021 14:35:46 GMT

hi, I want to create an alert that will trigger when 1 user (no specific user name, just one persong from the organization), deletes more than 5 files from DropBox.

I tried setting the following query:

host="ip-of-the-host-as-arrives-in-splunk" "event_type..tag"=file_delete | where count > 5

but how do I add the 1 user part ?

will love to get some help, I am new at this

Re: Trigger alert when 1 user deletes more than 5 files

ITWhisperer — Wed, 17 Nov 2021 14:53:07 GMT

What information do you have in your events?

Re: Trigger alert when 1 user deletes more than 5 files

mishmeret — Wed, 17 Nov 2021 15:07:02 GMT

I have all information relating the user, user name, email address, ip, action, id, etc...

Re: Trigger alert when 1 user deletes more than 5 files

ITWhisperer — Wed, 17 Nov 2021 15:09:15 GMT

| stats count by user