topic Re: how to make a query that will trigger when second query finds nothing. in Alerting

How to make a query that will trigger when second query finds nothing?

intrach — Mon, 21 Mar 2022 17:44:37 GMT

Hi,

I am a beginner in splunk and would like to ask if anyone can help me with creating a search or alert that would trigger if a certain condition 2 is not seen.

Example.

first condition is if src_ip has event 1234 and event 2345 that is allowed in WAF,

then second condition is to check if same src_ip does not have event 3456 in IPS.

Re: how to make a query that will trigger when second query finds nothing.

gcusello — Mon, 21 Mar 2022 07:45:21 GMT

Hi @intrach,

if in the second search you have less than 50,000 results, you could use something like this:

index=waf (src_ip="1234" OR src_ip="2345") NOT [ search index=ips src="3456" | dedup src_ip | fields src_ip ] | ...

if instead, you have more than 50,000 results in the second search, you have to use a different solution:

(index=waf (src_ip="1234" OR src_ip="2345")) OR (index=ips src="3456") | stats dc(index9 AS dc_index values(index) AS index BY src_ip | where dc_index=1 AND index=waf | ...

if you need more fields using the second search, you can add them as values in the stats command.

Ciao.

Giuseppe

Re: how to make a query that will trigger when second query finds nothing.

intrach — Mon, 21 Mar 2022 07:55:25 GMT

Hi Thanks,

It just got a bit more complicated, so now this is the use case we want to explore
a. Successful and blocked request from the same IP address in WAF
b. If the same IP in the WAF is blocked at the IPS, don’t alert

Any idea on this? Thank you so much

Re: how to make a query that will trigger when second query finds nothing.

gcusello — Mon, 21 Mar 2022 08:14:42 GMT

Hi @intrach,

let me understand: what are the conditions for successful and blocked in waf?

it should be action=allowed and action=denied.

Then you don't want to trigger if the src_ip is in ips, is it correct?

If this is the condition, you could run something like this:

index=waf (src_ip="1234" OR src_ip="2345") (action=allowed OR action=denied) NOT [ search index=ips src="3456" | dedup src_ip | fields src_ip ] | stats dc(action) AS dc_action BY src_ip | where dc_action=2

If the above condition aren't the ones you need, please, describe your conditions to test.

Ciao.

Giuseppe

Re: how to make a query that will trigger when second query finds nothing.

intrach — Mon, 21 Mar 2022 08:26:05 GMT

Thank you so much!

Re: how to make a query that will trigger when second query finds nothing.

gcusello — Mon, 21 Mar 2022 09:09:01 GMT

Hi @intrach,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉