topic Re: Detect IP Address Change Alert in Alerting

Detect IP Address Change Alert

byronhowell — Tue, 09 Jun 2020 22:03:57 GMT

Basically what I need to do is compare a user's authentication request to their most recent session start request and alert when they are different.

Example -
example@email.com sessions started with IP 12.145.123.
example@email.com authentication request IP 12.145.123
example@email.com authentication request with IP 58.145.12.125

I would want to see that authentication request as an alert.

Re: Detect IP Address Change Alert

richgalloway — Sun, 05 Apr 2020 13:26:24 GMT

Perhaps this will help.

index=foo "authentication request with IP" NOT [ search index=foo "session started with IP" | head 1 | fields ip_address | format ]

Re: Detect IP Address Change Alert

to4kawa — Sun, 05 Apr 2020 16:47:14 GMT

index=yours sourcetype=yours
| rex "(?<email>[\w.\-]+@[\w.\-]+)"
| rex "(?<msg>sessions started with IP|authentication request with IP)"
| rex "(?<ip>\d+\.\d+\.\d+\.\d+)"
| stats min(_time) as firstTime max(_time) as lastTime dc(msg) as auth dc(ip) as flag values(ip) as ip by email
| where flag > 1
| convert ctime(firstTime) ctime(lastTime)

Three rex extract the fields from event. you should fix it .
Email with different ip is malicious, so these display by where flag >1