How to create an alert based on the results of another alert in a different index

Path Finder

I currently have one alert that tells me if the results exceed more than 5k packets blocked by our firewall. I then have to check and see if the results have any packets allowed in Sourcefire. But only need to check the packets that exceeded 5k in the firewall.

Here is the search string that kicks off the alert of blocked firewall traffic.
index=firewalls sourcetype="cisco:asa" action=blocked description!="Debugging messages only" | fillnull value="n/a" | stats count by src_ip, dest_ip | search count>5000 | rename src_ip as SrcIP, dest_ip as DestIP

I then check in Sourcefire to see if any of those packets had any allowed packets in Sourcefire.
sourcetype="cisco:sourcefire:appliance:syslog" SrcIP="based on the results of the alert above" DstIP="based on the results of the alert above"

Can anyone help, please?

Tags (1)
0 Karma



I am not too familiar with Sourcefire, but if that information is kind of static (updated once a day) you might want to put that into a lookup within Splunk. That way you can lookup for each packet event if it is in your Sourcefire lookup and continue your work from there on.

In order to get the Sourcefire lookup, you can use a scheduled search that uses outputlookup.

Hope that helps.

All the best,

0 Karma

Path Finder

I would prefer to have this all within the same search string

0 Karma


You should either include the second search in with your first search by using an OR like the example below. OR you could setup a second alert which will monitor the internal logs and see when the first alert condition is true and fire its logic

index=firewall OR index=...

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...