topic Re: Make a Alert across 2 Fields in Alerting

Make a Alert across 2 Fields

coric — Wed, 10 Mar 2021 14:19:38 GMT

I'm trying to make an Alert trigger when the same source IP is more than 40 times, across more than 40 destination IP within 5 minutes. I'm not so sure how to accomplish this...

Re: Make a Alert across 2 Fields

gcusello — Wed, 10 Mar 2021 14:28:13 GMT

Hi @coric,

let me understand: do you want to find when one source IP is connected with more than 40 different destination IPs in 5 minutes or what else?

If this is your need, you should try something like this:

your_search earliest=-5m latest=now | stats dc(dest_IP) AS dc_dest_IP BY source_IP | where dc_dest_IP>40

Ciao.

Giuseppe

Re: Make a Alert across 2 Fields

coric — Wed, 10 Mar 2021 14:54:35 GMT

Perfect, that should work perfectly, il let you know!