What is the best way to set up a scheduled search to alert if there are more than 5 events from a specific user?

[CREVITCH]

I am looking to do a search every minute, and see if there are more than 5 events from a specific user. If so, I need to trigger an alert. I have this running as a scheduled search every minute, and it seems to be working. Is there a better way to do this? Should I be scheduling the search every hour and look for login events >5 in 1 minute windows? If so, how would I do that.

My current search looks like this

user=*   | eventstats count by user | where count > 5

start time -6m
finish time -5m
run every minute

[somesoni2 · Accepted solution]

It all depends upon the delay that is acceptable for your alert. Right now the delay is 5 min. So if you can allow delay for 20 mins, then run the search every 15 min, run a timechart for count and alert if any minute have count more than 5.

user=* | timechart span=1m count | where count> 5

Start time:  -20m@m
Finish time:  -15m@m

Cron: 5-59/15 * * * *

If you can allow delay of alert to 1 hour or so, run this hourly.

[CREVITCH]

Thanks! Exactly what I was looking for.