Alerting
Highlighted

Alert only if event has not been cleared within timeframe

Engager

Looking to alert based on the following scenario:

Event 1: Device: XYZ, Status: Clear, SHA: 12345, Time: 12:30
Event 2: Device: XYZ, Status: Blocked, SHA: 12345, Time: 12:15
Event 3: Device: ZZZ, Status: Blocked, SHA: 34567, Time: 12:10
Event 4: Device CCC, Status: Blocked, SHA: 45678, Time: 12:00

Alert for Event 3 and 4, but not for Event 1 or 2 since the status changed from Blocked to Clear within a certain timeframe, say 30 min, and the Device and SHA match.

Any help appreciated!

Labels (1)
Tags (1)
0 Karma
Highlighted

Re: Alert only if event has not been cleared within timeframe

Influencer

Hi @berkdana,

Try this.

| eventstats max(Time) as maxTime by Device, SHA 
| where Time=maxTime AND Status=="Blocked"

Sample query:

| makeresults 
| eval _raw="Device,Status,SHA,Time
XYZ,Clear,12345,12:30
XYZ,Blocked,12345,12:15
ZZZ,Blocked,34567,12:10
CCC,Blocked,45678,12:00" 
| multikv forceheader=1 
| fields - _time, _raw, linecount 
| eventstats max(Time) as maxTime by Device, SHA 
| where Time=maxTime AND Status=="Blocked"

View solution in original post

Highlighted

Re: Alert only if event has not been cleared within timeframe

Engager

This works as a general query, but not as a real time alert as it would alert the Blocked status ahead of the change to Cleared. Any advice on how to pause the search to allow, say fifteen minutes to see if a Cleared event pops up?

0 Karma