Alert on user with different src address

Question

Hello, I'm trying to setup an alert that fires when a user tries to log in from more than one src ip address within the last 24 hours.

My base search looks like index=myindex product=myvpnappliance

Src ip's and user fields are extracted automatically.

I've tried different searches to no effect. Can anybody please help?

Accepted Answer

0

Both appear to work, i still need to figure out how to setup an alert to fire when the source ip count for any user is greater than 1.

link

answered 16 Jun '11, 05:13

Joetron
753●1●4
accept rate: 20%

i am not sure what you mean but you just need click to create alert below this search. And Ziegfried search is the one to use as it is more efficient

(16 Jun '11, 05:25) MarioM

I understand the search and it does work, i also understand how to create alerts, since i have created them before. However, when i choose to create the alert, i only get three conditions: if number of events, hosts, source, and a custom condition. For now i'm just going to send an alert if that search returns any results, but ideally i would like an alert to fire as soon as a user is trying to connect from more than one unique src ip within a specified timeframe. I know this will require the search to run in real time and probably the use of a custom condition.

(16 Jun '11, 06:28) Joetron

Choose if number of events is greater than 0 since you're already evaluating the condition in the search string.

(16 Jun '11, 06:30) ziegfried ♦

Answer 2

4	this might be more efficient: `index=myindex product=myvpnappliance \| stats dc(src_ip) as src_ip_count by username \| where src_ip_count>1` link answered 15 Jun '11, 10:46 ziegfried ♦ 7.1k●1●3●15 accept rate: 53%

Answer 3

1

what about?

index=myindex product=myvpnappliance | transaction username maxspan=24h | where mvcount(src_ip) > 1 | table username src_ip

link

answered 15 Jun '11, 10:38

MarioM
1.4k●2●7
accept rate: 18%

2

While this should work, using transaction is a pretty inefficient approach for this particular case. Much better to use stats as ziegfried suggests.

(15 Jun '11, 16:21) southeringtonp ♦

Alert on user with different src address

Follow this question

Splunk Resources

Related questions