Keeping track of repeat offenders with loopkups

[Thuan]

I have set up a lookup table that consists of a number of offenses that need to be identified for every daily search. Each search works fine and output the IP along with the offending event. I need to keep track of these violations by IP over the time line. Notably when a threshold count has been exceeded, an alert is generated.

Your help is requested (1) in generating a file name that records the IP and the offense. The IP is not known until the violation happens. (2) Append additional violations to an IP is the file already exists and (3) trigger an alert if a threshold has been exceeded

[Thuan]

Thank you.
It works as you described.

[martin_mueller]

You could create a lookup table for that with columns such as ip, count, maybe more. When you find a new violation you load the lookup table and compute a new count for that ip, then use outputlookup to write it back to disk.

Your overall scenario sounds like you may want to look at the Splunk App for Enterprise Security though. Its handling of notable events and incidents may be exactly what you need. See http://apps.splunk.com/app/263/

[araitz]

See this blog post for an example of maintaining state with lookups:

http://blogs.splunk.com/2011/01/11/maintaining-state-of-the-union/