I want to create an alert that pops up when the events match at least 500 times the same source IP address, same destination address and different destination ports in 1 minute. The search I've come up with so far is as follows, although I'm not sure it's what I really need:
index=net-fw (src_ip=172.16.0.0/12 OR src_ip=10.0.0.0/8 OR src_ip=192.168.0.0/16) AND (dest_ip=172.16.0.0/12 OR dest_ip=10.0.0.0/8 OR dest_ip=192.168.0.0/16) action IN (allowed blocked)
| stats first(_time) as date dc(dest_port) as num_dest_port by src_ip, dest_ip | where num_dest_port >500 | convert ctime(date) as fecha
I think what I am missing to achieve is "with the same source IP and the same destination IP in one minute".
Could someone help me with this problem? Thanks in advance and best regards.
Try something like this
index=net-fw (src_ip=172.16.0.0/12 OR src_ip=10.0.0.0/8 OR src_ip=192.168.0.0/16) AND (dest_ip=172.16.0.0/12 OR dest_ip=10.0.0.0/8 OR dest_ip=192.168.0.0/16) action IN (allowed blocked)
| bin span=1m _time as minute
| stats first(_time) as date dc(dest_port) as num_dest_port by minute, src_ip, dest_ip
| where num_dest_port >500
| convert ctime(date) as fecha
Okay, thank you so much, I'll try that.