topic Re: Alert on user with different src address in Splunk Search

Alert on user with different src address

RicoSuave — Wed, 15 Jun 2011 17:33:24 GMT

Hello,
I'm trying to setup an alert that fires when a user tries to log in from more than one src ip address within the last 24 hours.

My base search looks like index=myindex product=myvpnappliance

Src ip's and user fields are extracted automatically.

I've tried different searches to no effect. Can anybody please help?

Re: Alert on user with different src address

MarioM — Wed, 15 Jun 2011 17:38:10 GMT

what about?

index=myindex product=myvpnappliance | transaction username maxspan=24h | where mvcount(src_ip) > 1 | table username src_ip

Re: Alert on user with different src address

ziegfried — Wed, 15 Jun 2011 17:46:06 GMT

this might be more efficient:

index=myindex product=myvpnappliance | stats dc(src_ip) as src_ip_count by username | where src_ip_count>1

Re: Alert on user with different src address

southeringtonp — Wed, 15 Jun 2011 23:21:00 GMT

While this should work, using transaction is a pretty inefficient approach for this particular case. Much better to use stats as ziegfried suggests.

Re: Alert on user with different src address

RicoSuave — Thu, 16 Jun 2011 12:13:32 GMT

Both appear to work, i still need to figure out how to setup an alert to fire when the source ip count for any user is greater than 1.

Re: Alert on user with different src address

MarioM — Thu, 16 Jun 2011 12:25:08 GMT

i am not sure what you mean but you just need click to create alert below this search.
And Ziegfried search is the one to use as it is more efficient

Re: Alert on user with different src address

RicoSuave — Thu, 16 Jun 2011 13:28:49 GMT

I understand the search and it does work, i also understand how to create alerts, since i have created them before. However, when i choose to create the alert, i only get three conditions: if number of events, hosts, source, and a custom condition. For now i'm just going to send an alert if that search returns any results, but ideally i would like an alert to fire as soon as a user is trying to connect from more than one unique src ip within a specified timeframe. I know this will require the search to run in real time and probably the use of a custom condition.

Re: Alert on user with different src address

ziegfried — Thu, 16 Jun 2011 13:30:55 GMT

Choose if number of events is greater than 0 since you're already evaluating the condition in the search string.