Alerting

How to create time based alert?

kvm
Explorer

Hello,

I'd ask for a help on how to write a query where I need to get an alert "when there's a user added to a specific group and then removed from the group within 1 Hour time."

I'm new to Splunk, any help appreciated.

Labels (1)
Tags (2)
0 Karma

kvm
Explorer

I have Microsoft Teams data.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Can you share some sample events (anonymised)?

0 Karma

kvm
Explorer

Here it is,

 

{"AADGroupId": "3100c98b-8326-454458-003423", "CommunicationType": "Team", "CreationTime": "2022-03-17T08:11:51", "ExtraProperties": [], "Id": "9a706da1-cf0-c66248e", "ItemName": "xxxxxxx", "Members": [{"DisplayName": "def, abc", "Role": 1, "UPN": "abc@teams.com"}], "Operation": "MemberAdded", "OrganizationId": "e092a8e1", "RecordType": 25, "TeamGuid": "19:NMnHsgIOE_r6fULTi5XzydC9g1@thr.acv2", "TeamName": "xxxxxxx", "UserId": "abc@teams.com", "UserKey": "0b6cedcb-2a3386", "UserType": 0, "Version": 1, "Workload": "MicrosoftTeams"}

{"AADGroupId": "0158b60c-34ba9b", "CommunicationType": "Team", "CreationTime": "2022-03-17T08:39:08", "ExtraProperties": [], "Id": "24214374ab6", "ItemName": "yyyyyyyyyy", "Members": [{"DisplayName": "def, abc", "Role": 3, "UPN": "abc@teams.com"}], "Operation": "MemberRemoved", "OrganizationId": "e092ae38-85aa8", "RecordType": 25, "TeamGuid": "19:ELsX6SdpXH5241@thr.acv2", "TeamName": "yyyyyyyyyy", "UserId": "abc@teams.com", "UserKey": "5f4381bd-7ed505", "UserType": 0, "Version": 1, "Workload": "MicrosoftTeams"}

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Assuming you have _time as the timestamp for the events, you can run a scheduled report over the last hour, say every 5 minutes and alert if you get any results

... your index
| spath Operation
| spath UserId
| eval timeadded=if(Operation="MemberAdded",_time,null())
| eval timeremoved=if(Operation="MemberRemoved",_time,null())
| stats values(timeadded) as timeadded values(timeremoved) as timeremoved by UserId
| where isnotnull(timeadded) AND isnotnull(timeremoved) and timeadded <= timeremoved
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Start with the data. What events do you have ingested into splunk?

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...