Hello, i want to make an alert that trigger when on a specific device, a user connect simultaneously from different IP.
My search is as follow :
source="My Source" | stats dc(src_ip) as count,values(src_ip) as src_ip by user | where count > 1
Thanks in advance
@gcusello , thanks for your answer.
Actually my source is my device.
when i add the device ip as device_id, there is no result.
Actually the request work but send me result when the same user as different ip in different moment of the day (that is "normal"), but i want only same user_id with different IP simultaneously.
in the BY cluase you have to add also the device identificator (name, id or IP).
source="My Source" | stats dc(src_ip) as count values(src_ip) as src_ip BY user device_id | where count > 1
P.S.: use always the index clause in the main search, you'll have more performant searches.
Ok easier the aspect of the device!
you could use something like this
source="My Source" | stats dc(src_ip) as count values(src_ip) as src_ip earliest(_time) AS earliest latest(_time) AS latest BY user device_id | where count > 1 AND latest-earliest<300
where you can configure the maximum accepted delay between events (in my example 300 seconds).