Make a Alert across 2 Fields

[coric]

I'm trying to make an Alert trigger when the same source IP is more than 40 times, across more than 40 destination IP within 5 minutes. I'm not so sure how to accomplish this...

[gcusello · Accepted solution]

Hi @coric,

let me understand: do you want to find when one source IP is connected with more than 40 different destination IPs in 5 minutes or what else?

If this is your need, you should try something like this:

your_search earliest=-5m latest=now
| stats dc(dest_IP) AS dc_dest_IP BY source_IP
| where dc_dest_IP>40

 Ciao.

Giuseppe

[coric]

Perfect, that should work perfectly, il let you know!