Other Usage

How to avoid duplicate alerts for 1 month of timespan

sasankganta
Path Finder

Hi,

I have a alert scheduled to monitor, if 2 different users who are accessing same device for authentication from okta and I'm monitoring it for 1 month.

Once the alert is triggered , the same users details should not trigger for next 1 month. Any suggestions how can I achieve this ? ( Can be in query / alert actions )

Below is sample query:


index=okta result=success NOT ( device=null)
| eval _time=strftime(_time)
| stats values (user ) as user dc(user) as "number of users per device" by device _time
| lookup XXX
| search "number of users per device">1
| regex device =myregx| rex field=user (myregex)
| where isnull(match)
| table fileds 
| stats fields X y Z dc(_time) as detected by device
| where detected>=1
| sort _time

Labels (1)
0 Karma

sasankganta
Path Finder

I mean by adding threshold conditions ?

0 Karma

sasankganta
Path Finder

@richgalloway and @ITWhisperer / Team , 

Apart from Throttling is there any way which we can automate the query / alert ? I'm looking to automate from query more over manual alert settings . Any suggestions will be helpful. Thank You.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Alerts are automated.  That is their nature.  Configurations can be manual, but are a one-time action.

Remember that each time an alert runs it is independent of other runs (context-free).  If you need context, other than what is provided by the throttling option, then you'll have to implement it yourself.

Triggering users/devices can be saved in a lookup file, KVStore, or (as @ITWhisperer suggested), a summary index.  The alert would need to consult the saved list to see if a new alert should be triggered or not.

---
If this reply helps you, Karma would be appreciated.
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What is it you are trying to automate? There is no generic way of doing this, you need to find a way which suits your situation.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Throttling alerts will stop the alert from being triggered, however, it is at the alert level, that is, if the alert should be triggered for a different user, I doubt if this would fire if you had a throttle on the alert.

What you could do is collect the results of the alert in a summary index and check against the summary index if the alert has been triggered for the user(s) within the last month.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Throttling of alerts is not done using SPL.  To enable throttling, edit the alert and check the "Throttle" box. Enter the time between alerts and click Save.

richgalloway_0-1692193665228.png

 

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...