Getting Data In

Trigger alert when 1 user deletes more than 5 files

mishmeret
Observer

hi, I want to create an alert that will trigger when 1 user (no specific user name, just one persong from the organization), deletes more than 5 files from DropBox.

I tried setting the following query:

host="ip-of-the-host-as-arrives-in-splunk" "event_type..tag"=file_delete | where count > 5

but how do I add the 1 user part ?

 

will love to get some help, I am new at this 

Labels (1)
Tags (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What information do you have in your events?

0 Karma

mishmeret
Observer

I have all information relating the user, user name, email address, ip, action, id, etc... 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| stats count by user
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...