Say I have a table of processes and IP addresses. I want to make an alert when a certain process was monitored in multiple computers during the last 24 hours. How can I do it?
Very specific question I know, I just didn't know how to phrase it otherwise.
@agentsofshield,
Try
your search|fields process,ipaddress|stats dc(ipaddress) as count,values(ipaddress) as ipaddress by process|where count >1
@agentsofshield,
Try
your search|fields process,ipaddress|stats dc(ipaddress) as count,values(ipaddress) as ipaddress by process|where count >1