Alerting

How to get a count of events that generates an alert after a host has more than X related events during a given period of time?

seaed_ac
Explorer

I am trying to have a count of events that generates an alert after a host has more than x USB related events during a given amount of time.

This is the type of event:

1   »  9/16/15
3:56:29.653 AM  
usn="46558922" time_stamp="2015-09-16 03:56:29.653 UTC" host_name="HOST" vapi_name="File Write" begin_time="2015-09-15 16:15:52.502 UTC" end_time="2015-09-15 17:00:44.533 UTC" caller_process_id="2128" caller_process_name="C:/Program.exe" parameter="F:/" user_name="SYSTEM" ip_addr="0.0.0.0" file_size="0" param_device_id="USBSTOR\Disk&Ven_HUAWEI&Prod_TF_CARD_Storage&Rev_2.31\7&12ad7558&0"
Tags (3)
0 Karma
1 Solution

woodcock
Esteemed Legend

Save this search and trigger for Number of events greater than 0:

... | stats count by host | where count < X

View solution in original post

somesoni2
Revered Legend

Try something like this

index=yourindex sourcetype=yoursourcetype param_device_id="USB*" | stats count by host_name | where count>yourXvalue

Set the alert condition as Where number of event > 0 from this search

0 Karma

woodcock
Esteemed Legend

Save this search and trigger for Number of events greater than 0:

... | stats count by host | where count < X

seaed_ac
Explorer

Hi there.
Thank you for your reply. How can I differentiate between the different hosts. Basically what I am trying to achieve is to be alerted when a user goes over a pre-defined number of files while using a usb external hdd. So far I get all the hosts together but I need to have it separated either by host_name or by user_name

0 Karma

woodcock
Esteemed Legend

The search already does count by host; if you need by host_name then do this:

 ... | stats count by host_name | where count < X
0 Karma
Get Updates on the Splunk Community!

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...