Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- How can I show results for a field that is disable...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How can I show results for a field that is disabled and not re-enabled in a certain amount of time?
I want to be alerted when AV protection on an endpoint is disabled for a period of time without being re-enabled. Ex: IF signature="Protection Disabled" AND (more than 5 minutes passes without Signature="Protection Enabled") THEN generate alert.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Make a list of all the other fields that are used to identify the target item in question. Let's assume for this example that it is host and service.
This gets you all the items that have been disabled for more than 5 minutes.
index=foo host=* service=* signature=* | stats latest(_time) as _time, latest(signature) as signature by host, service | where _time < relative_time(now(),"-5min") AND signature="Protection Disabled"
Now, if you want to find all the items where the signature stayed as "Protection Disabled" for more than 5 minutes, then you'll probably have to define a transaction starting with the signature="Protection Disabled" and ending with signature= anything else, and use the duration of the transaction to flag the results.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Make a list of all the other fields that are used to identify the target item in question. Let's assume for this example that it is host and service.
This gets you all the items that have been disabled for more than 5 minutes.
index=foo host=* service=* signature=* | stats latest(_time) as _time, latest(signature) as signature by host, service | where _time < relative_time(now(),"-5min") AND signature="Protection Disabled"
Now, if you want to find all the items where the signature stayed as "Protection Disabled" for more than 5 minutes, then you'll probably have to define a transaction starting with the signature="Protection Disabled" and ending with signature= anything else, and use the duration of the transaction to flag the results.
Splunkbase Unveils New App Listing Management Public Preview
Leveraging Automated Threat Analysis Across the Splunk Ecosystem
Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain
