How to search for events of the same type in the same IP subnet?

[shellnight]

I am trying to detect a virus outbreak in our network. Just want to check if 3 or more hosts have the same virusname in a subnet usually the first 24 bits match

Fields available

VirusName=conficker
Host IP address=X.X.X.X

[norbert_hamel]

Lets say you have logs containing the virus name and the host IP address like:

VirusName=conficker HostIP=192.168.1.100 
VirusName=conficker HostIP=192.168.1.101 
VirusName=conficker HostIP=192.168.1.102 
VirusName=conficker HostIP=10.0.0.101 
VirusName=conficker HostIP=10.0.0.102

Try a search that generates a new field for the subnet, containing only the first three oktets, and then perform a stats count by subnet:

search | rex field=HostIP "(?<Subnet>.*)\." | stats count(VirusName) AS Count by Subnet | where Count > 3

[somesoni2]

Try something like this

your base search | rex field=HostIP "^(?<IPSubnet>\d+\.\d+\.\d+)" | stats dc(HostIP) as AffectedHostCount by VirusName,IPSubnet | where AffectedHostCount >=3

[shellnight]

please can you provide a update on this issue

[shellnight]

thanks somesoni2 , can you have above search amended so it lists the events within the same hour and also shows computername

The field available are

virusname
hostip
computername