I am looking to do a search every minute, and see if there are more than 5 events from a specific user. If so, I need to trigger an alert. I have this running as a scheduled search every minute, and it seems to be working. Is there a better way to do this? Should I be scheduling the search every hour and look for login events >5 in 1 minute windows? If so, how would I do that.
My current search looks like this
user=* | eventstats count by user | where count > 5
start time -6m
finish time -5m
run every minute
It all depends upon the delay that is acceptable for your alert. Right now the delay is 5 min. So if you can allow delay for 20 mins, then run the search every 15 min, run a timechart for count and alert if any minute have count more than 5.
user=* | timechart span=1m count | where count> 5
Start time: -20m@m
Finish time: -15m@m
Cron: 5-59/15 * * * *
If you can allow delay of alert to 1 hour or so, run this hourly.
It all depends upon the delay that is acceptable for your alert. Right now the delay is 5 min. So if you can allow delay for 20 mins, then run the search every 15 min, run a timechart for count and alert if any minute have count more than 5.
user=* | timechart span=1m count | where count> 5
Start time: -20m@m
Finish time: -15m@m
Cron: 5-59/15 * * * *
If you can allow delay of alert to 1 hour or so, run this hourly.
Thanks! Exactly what I was looking for.