- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello,
We'd like to monitor configuration changes on our Linux host. For that we want to detect when in the datamodel Auditd
the field name
is equal to /etc/audit/*
, /etc/audisp/*
, or /etc/libaudit.conf
. Here is our basic search:
| tstats `security_content_summariesonly` count from datamodel=Auditd where nodename=Auditd.Path by _time span=1s host Auditd.name
| `drop_dm_object_name("Auditd")`
The question is how can we implement in the same search 3 conditions below:
| where like(name,"%/etc/audit/%")
| where like(name,"%/etc/audisp/%")
| where name="/etc/libaudit.conf"
Logicaly it could be done via case
statement, but we wasn't able to implement it. Do you have any ideas?
Thanks for the help.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Try something like
| tstats `security_content_summariesonly` count from datamodel=Auditd where nodename=Auditd.Path by _time span=1s host Auditd.name | `drop_dm_object_name("Auditd")`
| search name="*/etc/audit/*" OR name="*/etc/audisp/*" OR name="*/etc/libaudit.conf*"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Try something like
| tstats `security_content_summariesonly` count from datamodel=Auditd where nodename=Auditd.Path by _time span=1s host Auditd.name | `drop_dm_object_name("Auditd")`
| search name="*/etc/audit/*" OR name="*/etc/audisp/*" OR name="*/etc/libaudit.conf*"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Exactly!
Thanks for the help.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

how about a multiple if statement? if(like(name, "etc....%"), "etc",if(like(name, "%audisp%"), "audisp"))
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @cotyp,
With tstats
you can use only from
, where
and by
clause arguments. Personally I don't know how can I implement multiple if
statements with these argements 😞
