How do I trigger a search to start and stop with certain criteria

[jhilton90]

Basically, I want to create an alert than runs a particular search that we are running manually when the login failure limit is greater than 30. Then I want the search to stop once the login failure limit drops back below 15, then to output the results via email.

I am getting frustrated because I can't seem to find anything that I can use to achieve this result

Any help would be greatly appreciated

[ITWhisperer]

An alert is essentially a scheduled search which triggers alert actions e.g. send an email, based on whether certain conditions have been found by the search e.g. login failure limit (b)reached. When the conditions are not met, the alert will not trigger the actions. In order to have some sort of hysteresis effect, you would need to be able to track the previous states of the alerts. You could store previous conditions in an alternate store such as a csv or in a summary index, for example. Or your report could attempt to recalculate the previous results of past scheduled executions of the search.

[jhilton90]

So we already have logic in place where if there are a high number of failed logins within 1 minute for example, then an email gets sent out to let us know that we are experiencing X number of failed logins with a minute. That's when we also so the login failure limit spike up and come back down to a normal level