Splunk Alerting Rule for Recaptcha Served

[brewster88]

Afternoon All,

Just wanted to raise a question and get some ideas for a potential Splunk Alert that would trigger once a certain amount of recapture challenge requests per minute are served. Please note we ingest these logs from our WAF which in turns goes into an index labelled 'incapsula'

So Im currently using the below query.

index=incapsula AND site="Example*" AND act=REQ_CHALLENGE_CAPTCHA AND action=blocked | bucket span=1m _time | stats first(site) as site, count(request) as requests by _time |  where requests > 80 | dedup site

This gives decent information however its not really clear from the visualization or statistics if the results are the amount of times that requests per minute have gone over 80 in which case I need to add another column showing a count? or is this the actual data where number of requests has gone over 80 and thus gives me back information on any figure that went above 80 for that site?

Happy to provide more context/details if i can!

[sduff_splunk · Accepted solution]

I think what you are after is
index=incapsula AND site="Example*" AND act=REQ_CHALLENGE_CAPTCHA AND action=blocked
| bucket span=1m _time
| stats count(request) as requests by _time, site
| where requests > 80

This should tell you every minute where the number of requests for a particular site were greater than 80.

What is the purpose of the last |dedup site?

[brewster88]

Super useful! We were able to build something on this.

We have multiple websites labelled as 'site' in our Incapsula index and this was so we could see try to see where the stem of the issue was.

Took the dedup away as well and gave us the content we needed.

Thanks Kindly 🙂