Hi,
Looking for SPL like within a brief span of time, say two hours, a user prompts alerts for both PDM and encrypted files.
thanks
Hi @AL3Z,
probably you should try to better describe your requirement!
whick data source are you speaking?
why do you speak of Correlation Search?
did you checked if in Splunk baseline there's some Use Case for your technology?
did you checked if in Splunk Security essentials App there's some Use Case for your technology?
Ciao.
Giuseppe
@gcusello
Hi,
My requirement to find the where a user triggers both PDM and Encrypted file alerts in a short period of time (like 2 hours)
Datasource is of DLP
Ciao.
Hi @AL3Z,
could you share some sample of these two kind of alerts?
indicating the correlation key between them?
Ciao.
Giuseppe
..
Pls use above sample event for this use case
when User triggers diferent PDM alerts in a short period of time (EX Block on Gmail and block on external apps)...
hi @AL3Z,
this is one alert sample and the other?
could you highlight in bold the correlation key to use?
Ciao.
Giuseppe
Please find the sample event key points highlighted with red colour
Hi @AL3Z,
this is one kind of alert (PDM I suppose), can you share a sample of the other kind of alert or does it have the same format and only different message?
Ciao.
Giuseppe
@gcusello could you brief about PDM abbrevation and concept
Hi @AL3Z,
PDM is an acronym that I don't know and that you used.
In few words, you have to:
in this way , you should have something like this, to find events where user is present in both data sources:
(index=index1 sourcetype=sourcetype1) OR (index=index2 sourcetype=sourcetype2)
| stats dc(index) AS index_count values(index) AS index BY user
| where index_count=2
Ciao.
Giuseppe
Hi,
You're on different track my requirement is if single user triggers an alert say alert_name other than pdm in between 2 hours more than 3 times .
How could we achieve it using eval .
Thanks 👍
Hi @AL3Z,
so the condition is triggering an alert, not that the alert must be in both the indexes,
in this case, please try the same with a different final condition:
(index=index1 sourcetype=sourcetype1) OR (index=index2 sourcetype=sourcetype2)
| stats dc(index) AS index_count values(index) AS index values(pdm) AS pdm BY user
| where index_count=1 AND index=index1
the thing that I don't understand is what's the condition for pdm.
Ciao.
Giuseppe