I'm trying to find a way to create an alert if a new process has been started.
My old solution would learn the processes running on my servers for 15 days, then if a new process was started after the 15 days it would alert me to let me know. Then after that it wouldn't alert me again unless there was a 15-day gap.
For example, if I launch Google Chrome on a server every 16 days, I would get an alert letting me know the process was started.
You have to create a lookup (e.g. Processes.csv).
Schedule a search to populate lookup:
Yoursearch earliest=-15d latest= now
| dedup processes
| table process
| outputlookup Processes.csv
In this way you have a list of all processes in last 15 days.
After you can run you search
Yoursearch NOT [| inputlookup Processes.csv | fields process]
And use it For an alert.
To extract processes you have to create a script with ps command.