i have two conditions which has to be put in a same search.
conditon no 1:
if the Source address is in bad_ips.csv (lookup)
Number of Alerts received from IPS > 10 queries to DNS from same Source Address in 1 minute
Source Address are selected after comparing with the bad_ips look up .
Condition 2 :
if the source addresses are unknown,then
Number of Alerts received from IPS > 50 queries to DNS from same Source Address in 1 minute
kindly tell me about how to write the above conditions in the same search?
Index=ips (same for both)
As with some of your other posts, it's a bit hard to give you a search when you just give us the name of an index and the name of a lookup. Hopefully you understand that that is very little to go on.
So instead let's just talk about the process your search could use and then if you have more details you can share about the data, maybe we can help you actually write the search.
A couple questions. Are you planning to run this search over the past minute? Or do you want to run it over a longer period of time but do your evaluations in a minute interval? That will affect how the search is done.
Start with your base search, maybe
just index=ips. But if there is some
way to filter just the DNS queries up
front, that's probably a good idea.
In general, somewhere along the way
that will need to happen, so I'm just
going to assume it will be done here.
If running over a longer period of
time, Pipe to the the bucket command
and set your span to 1 minute for _time
Now pipe to stats to get a count by
Next lookup the source address in
your lookup file, assuming it will
output some new field to indicate
whether it was found?
Now filter your events with where (based on the output field from previous step) to
keep only those that have a count greater than
10 and in the badip list OR greater
than 50 and not in the list