Splunk Enterprise Security

When setting up an alert with a "saved search," why am I getting duplicate alerts for the same event with different event_id?

psmaan
New Member

I have set up an alert using a "Saved search" in Splunk Enterprise Security. I am throttling alerts for an hour when src, dest, and threat identifier are same. For the most part, this alert is working fine. However, every now and then I see anomalies like the ones below:

  1. Some time, I see that same alerts are fired twice in quick succession.

  2. Other times, I see the same alert fired a second time before Hour limit of throttling is over (e.g. second alert after 30-40 mins of first alert).

The event ID and event hash are different for different alerts. It seems 'notable' macro is assigning a different event_id to the same event. Now, I am wondering how is that possible and how do I fix this?

0 Karma

zonistj
Path Finder

What are your settings for Time Range? Specifically, earliest time, latest time, cron schedule, and schedule window?

It sounds like your saved search is running twice over the same data and generating different notable events for the same data. Throttling applies to each occurrence of the saved search, but has no affect on subsequent runs of that saved search. It could be something else but that's what I'd look at first.

0 Karma

psmaan
New Member

earliest time : -10m@m,
latest time: @m,
cron Schedule : Every 10 mins (*/10 * * * *) - This comment page has modified my cron impression to this.
schedule window (I think, we are referring to Time window here) : In my opinion, it should not have any impact as my search has earliest and latest time, however, I have set it as "Last 15 mins".
Search is set to run on cron schedule.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...