Hello, we have Splunk ES and using Malware datamodel.
Requirement is like this and everything need to be in one search. --- If a same malware signature is detected on 50 hosts in 10minutes window of search then we need a notable event Severity Low and the same signature is picked up in 100 hosts in 1 hour time then a new notable events with Severity Medium. If its picked up on 200 or more host in 6 hours then its High.
Thanks in advance...!!
