topic Re: Check if certain events occurs N consecutive times in Other Usage

How to check if certain events occurs N consecutive times?

SplunkExplorer — Thu, 22 Jun 2023 00:37:16 GMT

Hi Splunkers, I have to build a rule, based on Windows Logs (XML ones), that must check this:

Notify me is there are at least 3 consecutive occurreces of EventID 4776 from a list of host. Tje desiderd output must show:

Host
Number of consecutive events
User/account associated to events

So for example, if we have that

Host A has 4 consecutive events of EventID 4776 for user "Admin"
Host B has 19 consecutive events of EventID 4776 for user "Test"
Host C has 2 consecutive events of EventID 4776 for user "Joker"
Host D has 3 Events of EvenID 4776, but only 2 consecutive; than has another different event and only after this another occurrence of 4776 for user "Hello"

Host C don't match the consecutive count clause and must be escluded; same for Host D, because he has 3 events but not consecutive. The expected output is:

Host	User	N. of consecutive events
A	Admin	4
B	Test	19

What get me in stuck here is how to check that events are consecutive.Any suggestion?

Re: Check if certain events occurs N consecutive times

gcusello — Wed, 21 Jun 2023 13:30:09 GMT

Hi @SplunkExplorer,

let me understand: when you sai consecutive events, are you meaning events in the reference period or that between these events athere isn't any othe event?

In the first case, you can run a simple search like the following :

index=wineventlog Eventcode=4776 | stats count BY host user | where count>3

if the second the solution is more complex, I''l think to it.

Ciao.

Giuseppe

Re: Check if certain events occurs N consecutive times

SplunkExplorer — Wed, 21 Jun 2023 13:41:17 GMT

Hi @gcusello, it is the second option you mentioned: no other events between the desired one must be present.

For example:

15:00:00: Eventd ID 4776 for user gcusello
15:00:01: Eventd ID 4776 for user gcusello
15:00:02: Eventd ID 4776 for user gcusello

is fine, while:

15:00:00: Eventd ID 4776 for user gcusello
15:00:01: Eventd ID 4776 for user gcusello
15:00:02: Eventd ID 4625 for user gcusello
15:00:03: Eventd ID 4776 for user gcusello

it isn't.

Re: Check if certain events occurs N consecutive times

isoutamo — Wed, 21 Jun 2023 13:58:04 GMT

I think that this is doable with https://docs.splunk.com/Documentation/Splunk/9.0.5/SearchReference/Streamstats

Just use reset_before/after which suite better for you.

| streamstats reset_before="EventID!=4776" count by host user EventID | where count > 3