Create an alert when multiple files are deleted

[mishmeret]

Hi,

I am trying to create an alert that triggers when more than 5 files are deleted in less than 3 minutes from the app we monitor. 

For some reason, the alert only works for single file deletion but does not work when I set it for. a number of events. any idea why? would love to get some help

[isoutamo]

Can you post your SPL and some sample events?

[mishmeret]

attached a screen shot, in the actions it send an email to out ticking system

[isoutamo]

How about actual SPL query and event samples?

[mishmeret]

thats the query I used: host="ip-of the host" "event_type..tag"=file_delete

works for single file deletion

[mishmeret]

Screen Shot 2021-11-16 at 16.42.30.png