My query looks like this:
eventtype=ftnt_fgt_event subtype=system host="*" eventtype=ftnt_fgt_auth_privileged status=failed
|stats count by src_user,src,action
How would I check if this query produces results on an X timeframe like every 10min?
Like this, for rigid buckets:
eventtype=ftnt_fgt_event subtype=system host="*" eventtype=ftnt_fgt_auth_privileged status=failed
| bin span=10m _time
| stats count BY src_user, src, action, _time
OR this for a sliding window:
eventtype=ftnt_fgt_event subtype=system host="*" eventtype=ftnt_fgt_auth_privileged status=failed
| streamstats time_window=600 count BY src_user, src, action
Like this, for rigid buckets:
eventtype=ftnt_fgt_event subtype=system host="*" eventtype=ftnt_fgt_auth_privileged status=failed
| bin span=10m _time
| stats count BY src_user, src, action, _time
OR this for a sliding window:
eventtype=ftnt_fgt_event subtype=system host="*" eventtype=ftnt_fgt_auth_privileged status=failed
| streamstats time_window=600 count BY src_user, src, action
streamstats and eventstats command are the two which give me hard times everytime 🙂