How to create an alert based on the results of another alert in a different index

[fmpa_isaac]

I currently have one alert that tells me if the results exceed more than 5k packets blocked by our firewall. I then have to check and see if the results have any packets allowed in Sourcefire. But only need to check the packets that exceeded 5k in the firewall.

Here is the search string that kicks off the alert of blocked firewall traffic.
index=firewalls sourcetype="cisco:asa" action=blocked description!="Debugging messages only" | fillnull value="n/a" | stats count by src_ip, dest_ip | search count>5000 | rename src_ip as SrcIP, dest_ip as DestIP

I then check in Sourcefire to see if any of those packets had any allowed packets in Sourcefire.
sourcetype="cisco:sourcefire:appliance:syslog" SrcIP="based on the results of the alert above" DstIP="based on the results of the alert above"

Can anyone help, please?

[bjoernjensen]

Hi,

I am not too familiar with Sourcefire, but if that information is kind of static (updated once a day) you might want to put that into a lookup within Splunk. That way you can lookup for each packet event if it is in your Sourcefire lookup and continue your work from there on.

In order to get the Sourcefire lookup, you can use a scheduled search that uses outputlookup.

Hope that helps.

All the best,
Björn

[fmpa_isaac]

I would prefer to have this all within the same search string

[skoelpin]

You should either include the second search in with your first search by using an OR like the example below. OR you could setup a second alert which will monitor the internal logs and see when the first alert condition is true and fire its logic

index=firewall OR index=...