How to create time based alert?

[kvm]

Hello,

I'd ask for a help on how to write a query where I need to get an alert "when there's a user added to a specific group and then removed from the group within 1 Hour time."

I'm new to Splunk, any help appreciated.

[kvm]

I have Microsoft Teams data.

[ITWhisperer]

Can you share some sample events (anonymised)?

[kvm]

Here it is,

{"AADGroupId": "3100c98b-8326-454458-003423", "CommunicationType": "Team", "CreationTime": "2022-03-17T08:11:51", "ExtraProperties": [], "Id": "9a706da1-cf0-c66248e", "ItemName": "xxxxxxx", "Members": [{"DisplayName": "def, abc", "Role": 1, "UPN": "abc@teams.com"}], "Operation": "MemberAdded", "OrganizationId": "e092a8e1", "RecordType": 25, "TeamGuid": "19:NMnHsgIOE_r6fULTi5XzydC9g1@thr.acv2", "TeamName": "xxxxxxx", "UserId": "abc@teams.com", "UserKey": "0b6cedcb-2a3386", "UserType": 0, "Version": 1, "Workload": "MicrosoftTeams"}

{"AADGroupId": "0158b60c-34ba9b", "CommunicationType": "Team", "CreationTime": "2022-03-17T08:39:08", "ExtraProperties": [], "Id": "24214374ab6", "ItemName": "yyyyyyyyyy", "Members": [{"DisplayName": "def, abc", "Role": 3, "UPN": "abc@teams.com"}], "Operation": "MemberRemoved", "OrganizationId": "e092ae38-85aa8", "RecordType": 25, "TeamGuid": "19:ELsX6SdpXH5241@thr.acv2", "TeamName": "yyyyyyyyyy", "UserId": "abc@teams.com", "UserKey": "5f4381bd-7ed505", "UserType": 0, "Version": 1, "Workload": "MicrosoftTeams"}

[ITWhisperer]

Assuming you have _time as the timestamp for the events, you can run a scheduled report over the last hour, say every 5 minutes and alert if you get any results

... your index
| spath Operation
| spath UserId
| eval timeadded=if(Operation="MemberAdded",_time,null())
| eval timeremoved=if(Operation="MemberRemoved",_time,null())
| stats values(timeadded) as timeadded values(timeremoved) as timeremoved by UserId
| where isnotnull(timeadded) AND isnotnull(timeremoved) and timeadded <= timeremoved

[ITWhisperer]

Start with the data. What events do you have ingested into splunk?