Splunk Alert

jdrogers83 · ‎10-16-2019

I want to create an alert that will email us if we see any traffic that is not from a.b.c.d network communicating with w.x.y.z network (source or destination). I know I'm for sure missing stuff.

Thank you to any help!
Justin

diogofgm · ‎10-16-2019

Use this
index=nettraffic NOT ((source="a.b.c.d" dest="w.x.y.z") OR (dest="a.b.c.d" source="w.x.y.z"))

------------
Hope I was able to help you. If so, some karma would be appreciated.

saagar203 · ‎10-16-2019

query data with NOT keyword i.e. index="your index" NOT source="x.x.x.x" AND destination="x.x.x.x". Trigger alert when Number of records > 0 or whatever threshold.

Splunk Alert

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Data Outage Monitoring and Reporting

Manage Datasets and Connections in Catalog on Splunk Cloud Platform

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Join the Conversation

Splunk Alert

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Data Outage Monitoring and Reporting

Manage Datasets and Connections in Catalog on Splunk Cloud Platform

Persistent Queue at TcpOut — One of Splunk's Most Practical Features