Alerting

Anyway to query past fired alert base on certain field?

totaro
Explorer

Hi would like to check if this is possible:
Lets say i have an 2 alert:
alert A: check auth log for locked out in past 24 hour by ip
alert B: check netflow log for upload > 10gb in past 24 hour by ip

Is it possible for splunk to tell me x.x.x.x had trigger alert A on certain date, and trigger alert B on certain date when i query x.x.x.x?

The goal is to tie past alert that had fired to certain field, be it an IP or an account name
So i can easily check how 'suspicious' a user is based on his past triggered alert

0 Karma

lakshman239
Influencer

Yes possible. I assume both the alert details are stored in an index. Then you can create a search which can look for one or more specific fields and can bring in matching alerts - you would need to widen the search window.

0 Karma

totaro
Explorer

Hi what index would that be? i cant seem to find an index that show alert fired. the closest would be Activity > Triggered alerts but those are not searchable

0 Karma

jacobpevans
Motivator

index=_audit action=alert_fired

Only alerts that have a Trigger Action of "Add to Triggered Alerts" will show up here. However, there are no results from the alert displayed in this index unless you track down the search by the sid field. However, it is still possible. Here's an overview

Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.
Get Updates on the Splunk Community!

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...

From Alert to Resolution: How Splunk Observability Helps SREs Navigate Critical ...

It's 3:17 AM, and your phone buzzes with an urgent alert. Wire transfer processing times have spiked, and ...