How can I show results for a field that is disabled and not re-enabled in a certain amount of time?

[JRougeau]

How can I show results for a field that is disabled and not re-enabled in a certain amount of time?

I want to be alerted when AV protection on an endpoint is disabled for a period of time without being re-enabled. Ex: IF signature="Protection Disabled" AND (more than 5 minutes passes without Signature="Protection Enabled") THEN generate alert.

[DalJeanis · Accepted solution]

Make a list of all the other fields that are used to identify the target item in question. Let's assume for this example that it is host and service.

This gets you all the items that have been disabled for more than 5 minutes.

index=foo host=* service=* signature=* | stats latest(_time) as _time, latest(signature) as signature by host, service | where _time < relative_time(now(),"-5min") AND signature="Protection Disabled"

Now, if you want to find all the items where the signature stayed as "Protection Disabled" for more than 5 minutes, then you'll probably have to define a transaction starting with the signature="Protection Disabled" and ending with signature= anything else, and use the duration of the transaction to flag the results.