Splunk Search

How to create a query for alerting two different events from the same host?

Splunk77
Explorer

I am working on a query to report on host/s that have triggered two different event types. For example windows event IDs 4697 and 4698, if triggered by the same host, rule must alert.

 

EventType =4697

EventType =4698

HostName=What is the best way to imply host name being unique to the eventtypes.

To further clarify, if the same host triggers 4697 and 4698 in a 5 minute window, I want to report on that. 

Thanks in advance.

Labels (1)
0 Karma

norbertt911
Communicator

index="windows_events" Eventtype=4697 OR Eventtype=4698 |stats count by Hostname

0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...