Alerting

Splunk Alerting Rule for Recaptcha Served

brewster88
New Member

Afternoon All,

Just wanted to raise a question and get some ideas for a potential Splunk Alert that would trigger once a certain amount of recapture challenge requests per minute are served. Please note we ingest these logs from our WAF which in turns goes into an index labelled 'incapsula'

So Im currently using the below query.

index=incapsula AND site="Example*" AND act=REQ_CHALLENGE_CAPTCHA AND action=blocked | bucket span=1m _time | stats first(site) as site, count(request) as requests by _time |  where requests > 80 | dedup site

This gives decent information however its not really clear from the visualization or statistics if the results are the amount of times that requests per minute have gone over 80 in which case I need to add another column showing a count? or is this the actual data where number of requests has gone over 80 and thus gives me back information on any figure that went above 80 for that site?

Happy to provide more context/details if i can!

Tags (2)
0 Karma
1 Solution

sduff_splunk
Splunk Employee
Splunk Employee

I think what you are after is
index=incapsula AND site="Example*" AND act=REQ_CHALLENGE_CAPTCHA AND action=blocked
| bucket span=1m _time
| stats count(request) as requests by _time, site
| where requests > 80

This should tell you every minute where the number of requests for a particular site were greater than 80.

What is the purpose of the last |dedup site?

View solution in original post

0 Karma

sduff_splunk
Splunk Employee
Splunk Employee

I think what you are after is
index=incapsula AND site="Example*" AND act=REQ_CHALLENGE_CAPTCHA AND action=blocked
| bucket span=1m _time
| stats count(request) as requests by _time, site
| where requests > 80

This should tell you every minute where the number of requests for a particular site were greater than 80.

What is the purpose of the last |dedup site?

0 Karma

brewster88
New Member

Super useful! We were able to build something on this.

We have multiple websites labelled as 'site' in our Incapsula index and this was so we could see try to see where the stem of the issue was.

Took the dedup away as well and gave us the content we needed.

Thanks Kindly 🙂

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...