Creating search for malware infection

[ewonn]

Hi guys,
The team has created this search To Alerts when a host has an infection that has been re-infected remove multiple times over multiple days.

but we are not sure what we could do to get better results because alerts are coming a lot when we did this :

| tstats summariesonly=true allow_old_summaries=true dc(Malware_Attacks.date) as "day_count",count from datamodel="Malware"."Malware_Attacks" by "Malware_Attacks.dest","Malware_Attacks.signature","Malware_Attacks.action" | rename "Malware_Attacks.dest" as "dest","Malware_Attacks.signature" as "signature","Malware_Attacks.action" as action | where 'day_count'>5 | fields dest signature action day_count count | search signature!=unknown

Also do u guys know if the last pipe will break the search since it is a data model search

[ewonn]

Yes, Do u know if the last pipe will break the search since it is a data model search ?

[DalJeanis]

Are you looking for the value "unknown"? If so, put quotes around it.

[ewonn]

Yes, do u know if the last pipe will break the search since it is a data model search