https://community.splunk.com/t5/Splunk-Enterprise-Security/Correlation-Search-question-Enterprise-Security/m-p/158689#M641 <P>Hi, thanks, I will try this in the morning and let you know the results!</P> <P>... I did try the upgrade to ES 3 but had a few issues so I had to rollback, but it's good to know that the correlation searches are more efficient in ES 3.</P> Thu, 20 Feb 2014 00:05:18 GMT echojacques 2014-02-20T00:05:18Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Correlation-Search-question-Enterprise-Security/m-p/158687#M639 <P>Hello,</P> <P>This is a correlation search included with Enterprise Security that detects and alerts for potential spyware activity:</P> <PRE><CODE>| `src_dest_tracker("allowed")` | lookup local=true ip_spyware_lookup src OUTPUTNEW src_ip as src_spyware_ip,src_description,src_is_spyware | lookup local=true ip_spyware_lookup dest OUTPUTNEW dest_ip as dest_spyware_ip,dest_description,dest_is_spyware | search dest_is_spyware=true OR src_is_spyware=true | eval spyware_ip=if(dest_is_spyware=="true",dest_spyware_ip,spyware_ip) | eval spyware_ip=if(src_is_spyware=="true",src_spyware_ip,spyware_ip) | eval spyware_description=if(dest_is_spyware=="true",dest_description,spyware_description) | eval spyware_description=if(src_is_spyware=="true",src_description,spyware_description) | fields + sourcetype,src,dest,spyware_ip,spyware_description </CODE></PRE> <P>My question is, is there a way to tweak this search so that it only alerts when there are more than X number of events? In other words, let me know when an IP address triggers this rule 5 times (within a 24 hour period).</P> <P>I thought it was as simple as adding: "| search count&gt;5" to the end of the search string but it didn't work.</P> <P>Thanks for any tips!</P> Wed, 19 Feb 2014 23:34:40 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Correlation-Search-question-Enterprise-Security/m-p/158687#M639 echojacques 2014-02-19T23:34:40Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Correlation-Search-question-Enterprise-Security/m-p/158688#M640 <P>Hi,</P> <P>First and obligatory answer is upgrade, 3.0's version is much easier to read because of architectural improvements.... That said, I'd put <CODE>stats count(spyware_ip) as spyware_count by spyware_ip | search spyware_count&gt;5</CODE> at the end.</P> Wed, 19 Feb 2014 23:59:48 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Correlation-Search-question-Enterprise-Security/m-p/158688#M640 jcoates_splunk 2014-02-19T23:59:48Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Correlation-Search-question-Enterprise-Security/m-p/158689#M641 <P>Hi, thanks, I will try this in the morning and let you know the results!</P> <P>... I did try the upgrade to ES 3 but had a few issues so I had to rollback, but it's good to know that the correlation searches are more efficient in ES 3.</P> Thu, 20 Feb 2014 00:05:18 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Correlation-Search-question-Enterprise-Security/m-p/158689#M641 echojacques 2014-02-20T00:05:18Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Correlation-Search-question-Enterprise-Security/m-p/158690#M642 <P>This worked, thanks for the help!</P> Thu, 20 Feb 2014 21:31:07 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Correlation-Search-question-Enterprise-Security/m-p/158690#M642 echojacques 2014-02-20T21:31:07Z