Suggestions to write an alert if event B occurs without event A?

[sarahnazzar]

Hello Splunkers!

I have an event A from source A and event B from source B.

I need an alert when event B occurs without event A... Is this feasible? Could you please help me or post some suggestions?

Thanks in Advance!

[to4kawa]

(index=A source=A event=A) OR (index=B source=B event=B)
| eval common=coalesce(eventA,eventB)
| stats count(eval(source="A")) as A count(eval(source="B")) as B by common
| where B > 0 AND A = 0

[sarahnazzar]

Thanks for the response @to4kawa !

In my case, event A and event B are the raw events, I don't have any fields extracted over there..

[to4kawa]

well, why don't you provide sample logs?

[sarahnazzar]

PFB sample logs ,

EventA : Thu May 13 2020 00:15:05 mailsv1 sshd[4351]: Failed password for invalid user guest from 86.212.199.60 port 3771 ssh2

Event B : Thu May 13 2020 01:16:05 mailsv1 sshd[46748]: Received disconnect from 86.212.199.60: disconnected by user

[to4kawa]

two events have same ip address.
Let's extract and collect them.

[sarahnazzar]

Hi.. in some cases the IPs are not same.. we need to filter using the string "Failed password" and "Received disconnect" and frame the query..

Thanks for your response @to4kawa!

[to4kawa]

...
| rex "(?<status>Failed password|Received disconnect)"
| reverse
| streamstats dc(status) as status_count
| where status_count =1 AND status="Received disconnect"

when event count > 0 , fire alert.

[sarahnazzar]

Thanks for the response @to4kawa
I tried the using the query but its fetching event 2 even if event 1 occurred.

[Yulworm]

Hi @sarahnazzar , did you manage to get this working? Your comment implies that it does not work and I have not been able to adapt it to my, very similar, context

[ITWhisperer]

@Yulworm Please can you open a new providing more detail on your usecase?

[to4kawa]

If you are correct, then the event_count should be 2.