How to set up an alert to trigger if any values change for 3 fields from the last scan and now?

[kiran331]

Hi all,

From a scan report of Qualys, I will get IP and its PORT, TCP_PORT, UDP_PORT. Now when the scan is done after a week, if there is any change in PORT or TCP_PORT or UDP_PORT values, an alert should be triggered. Is there a way of comparing the two results?

for Example:

index="abc" IP=10.22.23.3 | table  LAST_SCAN_DATETIME, PORT, TCP_PORT,  UDP_PORT

IP=10.22.23.3
LAST_SCAN_DATETIME      
2016-06-05T06:32:42Z    ,  PORT - 8808, 2022.   TCP_PORT-135    UDP_PORT-123

2016-05-08T06:52:25Z       PORT - 8808. TCP_PORT-135    UDP_PORT-123    

A new port is added on 2016-06-05T06:32:42Z. How can I create an alert if there is any change in the values of these three fields?

[sundareshr]

Try this

index="abc" IP=10.22.23.3 | timechat span=1d  dc(PORT) as Port  dc(TCP_PORT) as TCP  dc(UDP_PORT) as UDP | delta Port | delta TCP | delta UDP | addtotals | where Total!=0

[jkat54 · Accepted solution]

Do you only want an alert if the last two scans are different?

If so try this:

 index="abc" IP=10.22.23.3 | head 2 | table PORT | transpose | where 'row 1'!='row 2'

For 3 or more past events, this solution becomes more difficult:

 index="abc" IP=10.22.23.3 | head 3 | table PORT | transpose | where 'row 1'!='row 2' OR 'row 1'!='row 3' OR 'row 2'!='row 3'     

[kiran331]

Thanks! Yes, i want an alert based on the last scan, But here i have 100+ of IP's and can i use more attributes PORT, TCP_PORT and UDP_PORT.