Two time condition searches – please help.

PiotrAp — Mon, 04 Dec 2023 15:58:19 GMT

I’m trying to create two searches and having some problems. I hope somebody could help me with this.

1. 7 or more IDS Alerts from a single IP Address in one minute.

I created something like below, but it doesn’t seem to be working correctly:

index=ids

| streamstats count time_window=1m by src_ip

| where count >=7

| stats values(dest_ip) as "Destination IP" values(attack) as "Attack" values(severity) as "Severity" values(host) as "FW" count by "Source IP"

2. 5 or more hosts in 1h attacked with the same IDS Signature

This seems to be even more complex as it has 3 conditions:

5 hosts
1h
The same IPS signature

So, I’m not sure how to even start after failing first one.

Could somebody help me with this please?

Re: Two time condition searches – please help.

richgalloway — Mon, 04 Dec 2023 16:12:38 GMT

What is incorrect about the first search?

Re: Two time condition searches – please help.

PiotrAp — Mon, 04 Dec 2023 16:17:57 GMT

I believe it doesn't show correct results. I mean, sometimes it shows one event in count for source IP, I presume should be min 5. Or I missed something?

topic Re: Two time condition searches – please help. in Splunk Search

Two time condition searches – please help.

Re: Two time condition searches – please help.

Re: Two time condition searches – please help.