Two time condition searches – please help.

[PiotrAp]

Hi

I’m trying to create two searches and having some problems. I hope somebody could help me with this.

1. 7 or more IDS Alerts from a single IP Address in one minute.

I created something like below, but it doesn’t seem to be working correctly:

index=ids

| streamstats count time_window=1m by src_ip

| where count >=7

| stats values(dest_ip) as "Destination IP" values(attack) as "Attack" values(severity) as "Severity" values(host) as "FW" count by "Source IP"

2. 5 or more hosts in 1h attacked with the same IDS Signature

This seems to be even more complex as it has 3 conditions:

• 5 hosts
• 1h
• The same IPS signature

So, I’m not sure how to even start after failing first one.

Could somebody help me with this please?

[richgalloway]

What is incorrect about the first search?

[PiotrAp]

I believe it doesn't show correct results. I mean, sometimes it shows one event in count for source IP, I presume should be min 5. Or I missed something?