Correlation search with count threshold (Enterprise Security)?

[echojacques]

We have Splunk Enterprise Security and use the correlation searches along with notable events for incident handling. We also have alerts setup. However, the alerts don't have the incident handling features that correlation searches and notable events do. So, I'd like to move our alerts into correlation searches. However, I'm not sure how to include a count threshold in a correlation search. For example:

Is it possible to move this alert:

sourcetype="firewall" action="denied" | stats count as Total   (Alert when over 1,000 events in 60 minutes)

... into a correlation search? Because when it's a correlation search, it would turn into a notable event for incident handling, which is what I'm trying to do with my alerts. But, I'm not sure how to configure the correlation search to only create a notable event when the event count for the search exceeds X over Y time period. Or, the alternative, would be to have alerts generate notable events, but I'm not sure how to do that either.

Thanks!

[dkuk]

... or as follows (during relevant time window) ...

sourcetype="firewall" action="denied" | stats count | where count>1000 

[echojacques · Accepted solution]

Ok, I figured it out. I just need to create a new correlation search and then append "search Total > 1000" to the end of the original alert's search, like this:

sourcetype="firewall" action="denied" | stats count as Total  | search Total > 1000

Then, for the time frame, that can be adjusted within the correlation search's time-range window. I tested this and it works great, now we'll be able to manage our alerts using notable events and incident management.