Custom Alerts in SPLUNK Enterprise

[willadams]

We have recently installed Enterprise Security and have enabled a few use cases. This was done with the guidance of SPLUNK Professional Services and for the most part the use cases, when they trigger, work (albeit with some tweaking). I am still very new to the world of data models and am still learning. What I would like to know is if I add in my own searches that don't use data models is this bad practise? For example most of the searches in ES are normal "|from datamodel "blah"". I want to put my searches based on a search, for arguments sake, the search is

"index=main sourcetype="sysmon" eventcode=4625 | where count > 50

The frequency of this search would be say every 20 minutes. If the count is >50 then the alert would trigger. I would then create this search under the "custom" app we have in the ES correlated searches to run.

[jawaharas]

You can create your correlation rule without using datamodel.

Although, it's recommended to use accelerated datamodel for the alerts that scheduled to run at frequent interval for better performance.

References:
Configure data models for Splunk Enterprise Security
Data models used by ES

[jawaharas]

@willadams
If my answer helped you, please accept and/or upvote it!