topic Re: How to create time based alert? in Alerting

How to create time based alert?

kvm — Thu, 17 Mar 2022 04:57:14 GMT

Hello,

I'd ask for a help on how to write a query where I need to get an alert "when there's a user added to a specific group and then removed from the group within 1 Hour time."

I'm new to Splunk, any help appreciated.

Re: How to create time based alert?

ITWhisperer — Thu, 17 Mar 2022 08:51:43 GMT

Start with the data. What events do you have ingested into splunk?

Re: How to create time based alert?

kvm — Thu, 17 Mar 2022 09:49:18 GMT

I have Microsoft Teams data.

Re: How to create time based alert?

ITWhisperer — Thu, 17 Mar 2022 10:14:04 GMT

Can you share some sample events (anonymised)?

Re: How to create time based alert?

kvm — Thu, 17 Mar 2022 10:31:45 GMT

Here it is,

{"AADGroupId": "3100c98b-8326-454458-003423", "CommunicationType": "Team", "CreationTime": "2022-03-17T08:11:51", "ExtraProperties": [], "Id": "9a706da1-cf0-c66248e", "ItemName": "xxxxxxx", "Members": [{"DisplayName": "def, abc", "Role": 1, "UPN": "abc@teams.com"}], "Operation": "MemberAdded", "OrganizationId": "e092a8e1", "RecordType": 25, "TeamGuid": "19:NMnHsgIOE_r6fULTi5XzydC9g1@thr.acv2", "TeamName": "xxxxxxx", "UserId": "abc@teams.com", "UserKey": "0b6cedcb-2a3386", "UserType": 0, "Version": 1, "Workload": "MicrosoftTeams"}

{"AADGroupId": "0158b60c-34ba9b", "CommunicationType": "Team", "CreationTime": "2022-03-17T08:39:08", "ExtraProperties": [], "Id": "24214374ab6", "ItemName": "yyyyyyyyyy", "Members": [{"DisplayName": "def, abc", "Role": 3, "UPN": "abc@teams.com"}], "Operation": "MemberRemoved", "OrganizationId": "e092ae38-85aa8", "RecordType": 25, "TeamGuid": "19:ELsX6SdpXH5241@thr.acv2", "TeamName": "yyyyyyyyyy", "UserId": "abc@teams.com", "UserKey": "5f4381bd-7ed505", "UserType": 0, "Version": 1, "Workload": "MicrosoftTeams"}

Re: How to create time based alert?

ITWhisperer — Thu, 17 Mar 2022 11:10:37 GMT

Assuming you have _time as the timestamp for the events, you can run a scheduled report over the last hour, say every 5 minutes and alert if you get any results

... your index | spath Operation | spath UserId | eval timeadded=if(Operation="MemberAdded",_time,null()) | eval timeremoved=if(Operation="MemberRemoved",_time,null()) | stats values(timeadded) as timeadded values(timeremoved) as timeremoved by UserId | where isnotnull(timeadded) AND isnotnull(timeremoved) and timeadded <= timeremoved