Alerting

How to create an alert via geostats count by Country

lukeasplunk
Observer

I am trying to create an alert based on sourcetype=iis | iplocation True_Client_IP | geostats count by Country that if one of my true client IPs show up in a Country where its not supposed to be it will generate an alert with the IPs listed.

I think I would some how need to input a list of locations that would trigger such an alert.  Any help on how to create such an alert would be appreciated.

Labels (1)
Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

If you just need an alert then geostats isn't necessary.  The iplocation command returns country names which you can then use in a normal stats command.

sourcetype=iis 
| iplocation True_Client_IP 
| stats count by Country
| where NOT Country=="United States"
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...