Alert only if event has not been cleared within timeframe

[berkdana]

Looking to alert based on the following scenario:

Event 1: Device: XYZ, Status: Clear, SHA: 12345, Time: 12:30
Event 2: Device: XYZ, Status: Blocked, SHA: 12345, Time: 12:15
Event 3: Device: ZZZ, Status: Blocked, SHA: 34567, Time: 12:10
Event 4: Device CCC, Status: Blocked, SHA: 45678, Time: 12:00

Alert for Event 3 and 4, but not for Event 1 or 2 since the status changed from Blocked to Clear within a certain timeframe, say 30 min, and the Device and SHA match.

Any help appreciated!

[manjunathmeti · Accepted solution]

Hi @berkdana,

Try this.

| eventstats max(Time) as maxTime by Device, SHA 
| where Time=maxTime AND Status=="Blocked"

Sample query:

| makeresults 
| eval _raw="Device,Status,SHA,Time
XYZ,Clear,12345,12:30
XYZ,Blocked,12345,12:15
ZZZ,Blocked,34567,12:10
CCC,Blocked,45678,12:00" 
| multikv forceheader=1 
| fields - _time, _raw, linecount 
| eventstats max(Time) as maxTime by Device, SHA 
| where Time=maxTime AND Status=="Blocked"

[berkdana]

This works as a general query, but not as a real time alert as it would alert the Blocked status ahead of the change to Cleared. Any advice on how to pause the search to allow, say fifteen minutes to see if a Cleared event pops up?