topic Re: how to create a threshold alert based on previous data? in Splunk Enterprise Security

how to create a threshold alert based on previous data?

ahmar74 — Tue, 29 Sep 2020 20:08:40 GMT

I started off with the following search which gives me failed authentication to cisco acs on a daily basis, now i want to alert when a spike occurred on either day. For example, Monday received 100 failed logins and the following monday we received 1000 failed logins, i want to alert when that occurs but i am stumped, any suggestions.

| tstats summariesonly count values(Authentication.action) as Action from datamodel="Authentication" where (index=acs Authentication.action="failure") by _time span=1day
| convert timeformat="%A %d %B" ctime(_time)

Re: how to create a threshold alert based on previous data?

Sukisen1981 — Sat, 23 Jun 2018 07:05:59 GMT

If I am getting this correct - you have some data on failed logins on a daily basis, and your alert trigger is based on a day of the week comparison? In the example that you have given,if on the previous Monday you had 100 failed logins and on the following Monday you have 101 failed logins , an alert should be triggered?. Is it possible to attach a snapshot of the output that you are receiving in your statistics tab? May be a mock up?

Re: how to create a threshold alert based on previous data?

renjith_nair — Sat, 23 Jun 2018 07:17:16 GMT

Hi @ahmar74,
Try this

|tstats summariesonly count values(Authentication.action) as Action from datamodel="Authentication" where (index=acs Authentication.action="failure") by _time span=1day
|eval week_day=strftime(_time,"%a")|sort week_day|streamstats current=f last(current) as prev by week_day
|eval diff=abs(current-prev)
|where diff > "your threshold value of spike"

Re: how to create a threshold alert based on previous data?

renjith_nair — Mon, 25 Jun 2018 13:18:12 GMT

Hi @ahmar74,
Did this work for you?

Re: how to create a threshold alert based on previous data?

Ghanayem1974 — Mon, 25 Jun 2018 14:16:34 GMT

it looks good but having issues with the where diff, as i don't know a number to input.

Re: how to create a threshold alert based on previous data?

Ghanayem1974 — Mon, 25 Jun 2018 14:19:06 GMT

actually i keep getting error 'The search job has failed due to an error.'

Re: how to create a threshold alert based on previous data?

Ghanayem1974 — Mon, 25 Jun 2018 14:57:06 GMT

it did not like summariesonly so i removed it, but i can use some help on the where diff >, any ideas? thanks.

Re: how to create a threshold alert based on previous data?

renjith_nair — Tue, 26 Jun 2018 02:10:10 GMT

Hi @Ghanayem1974, The value of threshold has to be decided by you based on your environment. You could think about a percentage also , for e.g. if the failures are more than 50% then alert e.t.c

Re: how to create a threshold alert based on previous data?

ghanayem74 — Tue, 26 Jun 2018 04:25:23 GMT

how would I write that?

Re: how to create a threshold alert based on previous data?

renjith_nair — Tue, 26 Jun 2018 07:47:57 GMT

Try this run anywhere example

|tstats count as current where index=_internal by _time
 |eval week_day=strftime(_time,"%a")|sort week_day
 |streamstats current=f last(current) as prev by week_day|fillnull value="NA"
 |eval diff=if(prev=="NA",current,abs(current-prev))
 |eval perc_of_change=round((diff/prev)*100,2)|where perc_of_change > 20