topic Re: Alert if event B occurs without event A in Alerting

Suggestions to write an alert if event B occurs without event A?

sarahnazzar — Tue, 08 Nov 2022 15:27:54 GMT

Hello Splunkers!

I have an event A from source A and event B from source B.

I need an alert when event B occurs without event A... Is this feasible? Could you please help me or post some suggestions?

Thanks in Advance!

Re: Alert if event B occurs without event A

to4kawa — Thu, 21 May 2020 09:22:11 GMT

(index=A source=A event=A) OR (index=B source=B event=B)
| eval common=coalesce(eventA,eventB)
| stats count(eval(source="A")) as A count(eval(source="B")) as B by common
| where B > 0 AND A = 0

Re: Alert if event B occurs without event A

sarahnazzar — Thu, 21 May 2020 10:01:37 GMT

Thanks for the response @to4kawa !

In my case, event A and event B are the raw events, I don't have any fields extracted over there..

Re: Alert if event B occurs without event A

to4kawa — Thu, 21 May 2020 10:17:07 GMT

well, why don't you provide sample logs?

Re: Alert if event B occurs without event A

sarahnazzar — Thu, 21 May 2020 11:53:58 GMT

PFB sample logs ,

EventA : Thu May 13 2020 00:15:05 mailsv1 sshd[4351]: Failed password for invalid user guest from 86.212.199.60 port 3771 ssh2

Event B : Thu May 13 2020 01:16:05 mailsv1 sshd[46748]: Received disconnect from 86.212.199.60: disconnected by user

Re: Alert if event B occurs without event A

to4kawa — Thu, 21 May 2020 21:00:56 GMT

two events have same ip address.
Let's extract and collect them.

Re: Alert if event B occurs without event A

sarahnazzar — Wed, 27 May 2020 08:30:04 GMT

Hi.. in some cases the IPs are not same.. we need to filter using the string "Failed password" and "Received disconnect" and frame the query..

Thanks for your response @to4kawa!

Re: Alert if event B occurs without event A

to4kawa — Wed, 27 May 2020 08:59:04 GMT

...
| rex "(?<status>Failed password|Received disconnect)"
| reverse
| streamstats dc(status) as status_count
| where status_count =1 AND status="Received disconnect"

when event count > 0 , fire alert.

Re: Alert if event B occurs without event A

sarahnazzar — Tue, 02 Jun 2020 13:06:23 GMT

Thanks for the response @to4kawa
I tried the using the query but its fetching event 2 even if event 1 occurred.

Re: Alert if event B occurs without event A

to4kawa — Wed, 03 Jun 2020 11:11:13 GMT

If you are correct, then the event_count should be 2.

Re: Alert if event B occurs without event A

Yulworm — Fri, 04 Nov 2022 21:27:07 GMT

Hi @sarahnazzar , did you manage to get this working? Your comment implies that it does not work and I have not been able to adapt it to my, very similar, context

Re: Alert if event B occurs without event A

ITWhisperer — Sat, 05 Nov 2022 07:03:16 GMT

@Yulworm Please can you open a new providing more detail on your usecase?