Alerting

How to make a query that will trigger when second query finds nothing?

intrach
Explorer

Hi,

I am a beginner in splunk and would like to ask if anyone can help me with creating a search or alert that would trigger if a certain condition 2 is not seen.

Example. 

first condition is if src_ip has event 1234 and event 2345 that is allowed in WAF,

then  second condition is to check if same src_ip does not have event 3456 in IPS.

 

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @intrach,

let me understand: what are the conditions for successful and blocked in waf?

it should be action=allowed and action=denied.

Then you don't want to trigger if the src_ip is in ips, is it correct?

If this is the condition, you could run something like this:

index=waf (src_ip="1234" OR src_ip="2345") (action=allowed OR action=denied) NOT [ search index=ips src="3456" | dedup src_ip | fields src_ip ]
| stats dc(action) AS dc_action BY src_ip
| where dc_action=2

If the above condition aren't the ones you need, please, describe your conditions to test.

Ciao.

Giuseppe

 

View solution in original post

intrach
Explorer

Hi Thanks,

It just got a bit more complicated, so now this is the use case we want to  explore
a. Successful and blocked request from the same IP address in WAF
b. If the same IP in the WAF is blocked at the IPS, don’t alert


Any idea on this? Thank you so much

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @intrach,

let me understand: what are the conditions for successful and blocked in waf?

it should be action=allowed and action=denied.

Then you don't want to trigger if the src_ip is in ips, is it correct?

If this is the condition, you could run something like this:

index=waf (src_ip="1234" OR src_ip="2345") (action=allowed OR action=denied) NOT [ search index=ips src="3456" | dedup src_ip | fields src_ip ]
| stats dc(action) AS dc_action BY src_ip
| where dc_action=2

If the above condition aren't the ones you need, please, describe your conditions to test.

Ciao.

Giuseppe

 

intrach
Explorer

Thank you so much!

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @intrach,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

gcusello
SplunkTrust
SplunkTrust

Hi @intrach,

if in the second search you have less than 50,000 results, you could use something like this:

index=waf (src_ip="1234" OR src_ip="2345") NOT [ search index=ips src="3456" | dedup src_ip | fields src_ip ]
| ...

if instead, you have more than 50,000 results in the second search, you have to use a different solution:

(index=waf (src_ip="1234" OR src_ip="2345")) OR (index=ips src="3456")
| stats dc(index9 AS dc_index values(index) AS index BY src_ip
| where dc_index=1 AND index=waf
| ...

if you need more fields using the second search, you can add them as values in the stats command.

Ciao.

Giuseppe

Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...