topic Re: How to Create Conditional Alerting based on Lookup Tables in Splunk Enterprise Security

How to Create Conditional Alerting based on Lookup Tables

jj39501 — Tue, 29 Sep 2020 22:19:36 GMT

I currently have alerting setup for authentications that occur from outside of the country. However, I would like to suppress alerting for specific users for x amount of time.

For example an alert for John Smith logging from Australia. Once I validate that this in fact John Smith, I want to write this entry to a lookup table and suppress any future alerts from him for lets a say 1 week to avoid alarm fatigue. Below is what I have so far. Not sure where to go from here or if i'm even headed the right direction with this.

index="authenticatior" action=success | search "location.country"!="" AND "location.country"!="US" | table _time device,username,user_first,user_last,user_managedBy,factor,integration,result,location.city,location.country
|eval _time=strftime(_time, "%m/%d/%y %I:%M:%S:%p")
| rename _time as Timestamp location.city as City, location.country as Country user_managedBy as Manager username as "User ID" user_first as First, user_last as Last, factor as Factor integration as Integration result as Result device as Device
| sort Last
| inputlookup append=t mylookup.csv
| outputlookup mylookup.csv

Re: How to Create Conditional Alerting based on Lookup Tables

whrg — Mon, 10 Dec 2018 09:23:28 GMT

Instead of using a lookup table, how about using the throttle feature for alerts? You could throttle your alert based on the username.

Re: How to Create Conditional Alerting based on Lookup Tables

jj39501 — Mon, 10 Dec 2018 13:36:25 GMT

whrg,

I will give this a try and validate over the next few days. Thanks

Re: How to Create Conditional Alerting based on Lookup Tables

jj39501 — Sun, 16 Dec 2018 21:47:47 GMT

So I have tested this out for an entire week and unfortunately it suppressed ALL alerts which is not the desired outcome. I would like to be alerted for each different user and suppress alerts for that individual user for 7 days. Hope this makes sense.

Re: How to Create Conditional Alerting based on Lookup Tables

whrg — Mon, 17 Dec 2018 07:34:26 GMT

I see you are renaming the field "username" to "User ID" in your search above.
So you should enter "User ID" in the field "Supress results containing field value".
(However, I'm not sure if spaces are accepted or if you have to use double quotes.)

Re: How to Create Conditional Alerting based on Lookup Tables

jj39501 — Mon, 17 Dec 2018 13:06:09 GMT

I did try the User ID field initially, but not with the double quotes. I will try this and provide feedback.

Re: How to Create Conditional Alerting based on Lookup Tables

whrg — Mon, 17 Dec 2018 13:18:39 GMT

If it doesn't work, then don't rename "username", or rename username to User_ID (without spaces).

Re: How to Create Conditional Alerting based on Lookup Tables

jj39501 — Tue, 25 Dec 2018 03:29:13 GMT

I have tried both suggestions at this time. Rewrote the alert and kept the original username field as is. However, all alerts are being suppressed as opposed to repeat user logins. Thinking the lookup table might be the more viable option here,