Correlation Search question (Enterprise Security)

[echojacques]

Hello,

This is a correlation search included with Enterprise Security that detects and alerts for potential spyware activity:

| `src_dest_tracker("allowed")` | lookup local=true ip_spyware_lookup src OUTPUTNEW src_ip as src_spyware_ip,src_description,src_is_spyware | lookup local=true ip_spyware_lookup dest OUTPUTNEW dest_ip as dest_spyware_ip,dest_description,dest_is_spyware | search dest_is_spyware=true OR src_is_spyware=true | eval spyware_ip=if(dest_is_spyware=="true",dest_spyware_ip,spyware_ip) | eval spyware_ip=if(src_is_spyware=="true",src_spyware_ip,spyware_ip) | eval spyware_description=if(dest_is_spyware=="true",dest_description,spyware_description) | eval spyware_description=if(src_is_spyware=="true",src_description,spyware_description) | fields + sourcetype,src,dest,spyware_ip,spyware_description

My question is, is there a way to tweak this search so that it only alerts when there are more than X number of events? In other words, let me know when an IP address triggers this rule 5 times (within a 24 hour period).

I thought it was as simple as adding: "| search count>5" to the end of the search string but it didn't work.

Thanks for any tips!

[jcoates_splunk · Accepted solution]

Hi,

First and obligatory answer is upgrade, 3.0's version is much easier to read because of architectural improvements.... That said, I'd put stats count(spyware_ip) as spyware_count by spyware_ip | search spyware_count>5 at the end.

[echojacques]

This worked, thanks for the help!

[echojacques]

Hi, thanks, I will try this in the morning and let you know the results!

... I did try the upgrade to ES 3 but had a few issues so I had to rollback, but it's good to know that the correlation searches are more efficient in ES 3.