How to trigger alerts on the count of the value of a custom field?

[olawalePS]

I am trying to create an alert for multiple failed logins but my query doesn't seem to work.

The alert is detailed in the image attached, and the query is:

index="authenticate" eventType="user.session.start" outcome.result="FAILURE"
| stats count by actor.alternateId

Please help correct the query.

[gcusello · Accepted solution]

Hi @olawalePS,

insert the condition in the search:

index="authenticate" eventType="user.session.start" outcome.result="FAILURE"
| stats count by actor.alternateId
| where count>3

and trigger the alert when results>0

then I don't like to have dots in a field so I prefer:

index="authenticate" eventType="user.session.start" outcome.result="FAILURE"
| rename actor.alternateId AS alternateId
| stats count by alternateId
| where count>3

Ciao.

Giuseppe

[olawalePS]

I modified the search but it still did not trigger an alert. is the cron job schedule configured correctly?

I attached the screenshot of the config

[gcusello]

Hi @olawalePS,

your search is schedule to run one time a week (Monday at 6:00) on the last 10 minutes, is it correct?

Ciao.

Giuseppe

[olawalePS]

@gcusello No, I want it to run every 10 minutes.

[olawalePS]

@gcusello I have corrected the cron expression. Thanks for helping to point it out