Alerting

Correlation search with count threshold (Enterprise Security)?

echojacques
Builder

We have Splunk Enterprise Security and use the correlation searches along with notable events for incident handling. We also have alerts setup. However, the alerts don't have the incident handling features that correlation searches and notable events do. So, I'd like to move our alerts into correlation searches. However, I'm not sure how to include a count threshold in a correlation search. For example:

Is it possible to move this alert:

sourcetype="firewall" action="denied" | stats count as Total   (Alert when over 1,000 events in 60 minutes)

... into a correlation search? Because when it's a correlation search, it would turn into a notable event for incident handling, which is what I'm trying to do with my alerts. But, I'm not sure how to configure the correlation search to only create a notable event when the event count for the search exceeds X over Y time period. Or, the alternative, would be to have alerts generate notable events, but I'm not sure how to do that either.

Thanks!

Tags (2)
0 Karma
1 Solution

echojacques
Builder

Ok, I figured it out. I just need to create a new correlation search and then append "search Total > 1000" to the end of the original alert's search, like this:

sourcetype="firewall" action="denied" | stats count as Total  | search Total > 1000

Then, for the time frame, that can be adjusted within the correlation search's time-range window. I tested this and it works great, now we'll be able to manage our alerts using notable events and incident management.

View solution in original post

0 Karma

dkuk
Path Finder

... or as follows (during relevant time window) ...

sourcetype="firewall" action="denied" | stats count | where count>1000 
0 Karma

echojacques
Builder

Ok, I figured it out. I just need to create a new correlation search and then append "search Total > 1000" to the end of the original alert's search, like this:

sourcetype="firewall" action="denied" | stats count as Total  | search Total > 1000

Then, for the time frame, that can be adjusted within the correlation search's time-range window. I tested this and it works great, now we'll be able to manage our alerts using notable events and incident management.

0 Karma
Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...