How to create a search with condition verification?

[ivan123357]

Hi!

I am faced with the following task and do not understand which way to go. I want to create an alert that will be triggered when a certain application is deleted. For example:

index=main source=<custom_source> Message="<program_name> is uninstalled"

Everything works as it should, I use the internal event type and that's not the question. Some software generates 2 events when UPDATING OR UPGRADING, the first: the program is uninstalled and the second: the program is installed. Therefore, in this case, my alert gives a false alarm. I have generated the following alert logic to correct false positives:

Search events for the last 30 Minutes:
index=main source=<custom_source> Message="<program_name> is uninstalled" 
Next we need to check whether there were installation events: 
index=main source=<custom_source> Message="<program_name> is installed" on the machines from the first request.
And if there was no installation event on the machine after the uninstalled event in the last 30 minutes, then issue an alert.

 I cant create a query from this logic. If you could help me with advice, I would be very grateful.

P.S. We looked in the direction of events from the application log and MSI Installer Logs, but in our case this is not applicable and we must use custom source.

Thanks for you help, have a nice day.

[richgalloway · Accepted solution]

Look for both install and uninstall events from the same machine/program and keep the most recent event for each.  If the latest event is "uninstall" and it's been more than 30 minutes then trigger an alert.

index=main source=<custom_source> (Message="<program_name> is uninstalled" OR Message="<program_name> is installed")
| dedup host <program_name> Message 
| where Message="<program_name> is uninstalled" AND _time<relative_time(now(), "-30m")

[ivan123357]

Oh, thanks! It is working in the most cases. I found that it turns out there are cases when the installation event (new version) is generated faster than the removal event (old version). There are not many such cases, about 50 hits per week, but maybe it is possible to take this case in query? Thank you again so much for your help.

[richgalloway]

I'm not sure how to handle that case, but perhaps someone else will have an idea.