Alerting

What is the best way to set up a scheduled search to alert if there are more than 5 events from a specific user?

CREVITCH
Path Finder

I am looking to do a search every minute, and see if there are more than 5 events from a specific user. If so, I need to trigger an alert. I have this running as a scheduled search every minute, and it seems to be working. Is there a better way to do this? Should I be scheduling the search every hour and look for login events >5 in 1 minute windows? If so, how would I do that.

My current search looks like this

user=*   | eventstats count by user | where count > 5

start time -6m
finish time -5m
run every minute

0 Karma
1 Solution

somesoni2
Revered Legend

It all depends upon the delay that is acceptable for your alert. Right now the delay is 5 min. So if you can allow delay for 20 mins, then run the search every 15 min, run a timechart for count and alert if any minute have count more than 5.

user=* | timechart span=1m count | where count> 5

Start time:  -20m@m
Finish time:  -15m@m

Cron: 5-59/15 * * * *

If you can allow delay of alert to 1 hour or so, run this hourly.

View solution in original post

somesoni2
Revered Legend

It all depends upon the delay that is acceptable for your alert. Right now the delay is 5 min. So if you can allow delay for 20 mins, then run the search every 15 min, run a timechart for count and alert if any minute have count more than 5.

user=* | timechart span=1m count | where count> 5

Start time:  -20m@m
Finish time:  -15m@m

Cron: 5-59/15 * * * *

If you can allow delay of alert to 1 hour or so, run this hourly.

CREVITCH
Path Finder

Thanks! Exactly what I was looking for.

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...