Help with Splunk alert to identify application control violation

[radparik]

Hello,

I am trying to figure out how to have Splunk detect multiple application control violations on the system. Looking to have the alert trigger if there are more than 5 windows events from a single IP source.

Does anyone know how I can go about this?

[richgalloway]

It would help to have more information about your use case.  In general, it's like this: read events, count them, filter on the count, trigger an alert.

index=windows
| stats count by ip
| where count > 5

Have the alert trigger when the number of results from this search is not zero.