Alerting

Correlation search with count threshold (Enterprise Security)?

echojacques
Builder

We have Splunk Enterprise Security and use the correlation searches along with notable events for incident handling. We also have alerts setup. However, the alerts don't have the incident handling features that correlation searches and notable events do. So, I'd like to move our alerts into correlation searches. However, I'm not sure how to include a count threshold in a correlation search. For example:

Is it possible to move this alert:

sourcetype="firewall" action="denied" | stats count as Total   (Alert when over 1,000 events in 60 minutes)

... into a correlation search? Because when it's a correlation search, it would turn into a notable event for incident handling, which is what I'm trying to do with my alerts. But, I'm not sure how to configure the correlation search to only create a notable event when the event count for the search exceeds X over Y time period. Or, the alternative, would be to have alerts generate notable events, but I'm not sure how to do that either.

Thanks!

Tags (2)
0 Karma
1 Solution

echojacques
Builder

Ok, I figured it out. I just need to create a new correlation search and then append "search Total > 1000" to the end of the original alert's search, like this:

sourcetype="firewall" action="denied" | stats count as Total  | search Total > 1000

Then, for the time frame, that can be adjusted within the correlation search's time-range window. I tested this and it works great, now we'll be able to manage our alerts using notable events and incident management.

View solution in original post

0 Karma

dkuk
Path Finder

... or as follows (during relevant time window) ...

sourcetype="firewall" action="denied" | stats count | where count>1000 
0 Karma

echojacques
Builder

Ok, I figured it out. I just need to create a new correlation search and then append "search Total > 1000" to the end of the original alert's search, like this:

sourcetype="firewall" action="denied" | stats count as Total  | search Total > 1000

Then, for the time frame, that can be adjusted within the correlation search's time-range window. I tested this and it works great, now we'll be able to manage our alerts using notable events and incident management.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...