How can I do stats by eventtype?

[daniel333]

All,

I have three eventtypes

[insecure_telnet]
app=telnet OR dest_port=23

[insecure_snmp]
app=snmp OR dest_port=1234

[insecure_rdp]
app=rdp OR dest_port=4321

I'd like the email alert I get to have the protocol I don't trust in the email header.
e.g.
ALert - insecure Service TELNET detected on HOST

Rather than write an alert for each insecure protocol I don't trust I was hoping just to bind all these together like

index=os eventtype=insecure_telnet OR eventtype=insecure_snmp

I figured I can stats by eventtype, but that doesnt' quite cut it since it includes other eventtypes. Is there maybe a way to use eventstats or a eval to create a field which states the insecure protocol?

[xpac · Accepted solution]

Hey, you can either reduce your result like this:

| stats by eventtype
| where eventtype=insecure_telnet OR eventtype=insecure_snmp OR eventtype=insecure_rdp

You could also create a new eval'd field like this:

| eval insecure_protocol=case(app=telnet OR dest_port=23, "telnet", app=snmp OR dest_port=1234, "snmp", app=rdp OR dest_port=4321, "rdp")

Both is possible 😉

Hope that helps - if it does I'd be happy if you would upvote/accept this answer, so others could profit from it. 🙂