Solved: How to create an alert when process appears in mul...

agentsofshield · ‎09-04-2018

Say I have a table of processes and IP addresses. I want to make an alert when a certain process was monitored in multiple computers during the last 24 hours. How can I do it?

Very specific question I know, I just didn't know how to phrase it otherwise.

renjith_nair · ‎09-04-2018

@agentsofshield,

Try

your search|fields process,ipaddress|stats dc(ipaddress) as count,values(ipaddress) as ipaddress by process|where count >1

---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

renjith_nair · ‎09-04-2018

@agentsofshield,

Try

your search|fields process,ipaddress|stats dc(ipaddress) as count,values(ipaddress) as ipaddress by process|where count >1

---
What goes around comes around. If it helps, hit it with Karma 🙂

How to create an alert when process appears in multiple IPs?

Enter the Dashboard Challenge and Watch the .conf24 Global Broadcast!

Join Us at the Builder Bar at .conf24 – Empowering Innovation and Collaboration

Combine Multiline Logs into a Single Event with SOCK - a Guide for Advanced Users