I'm having trouble building an alert. I want to get alerted, if during a 4 hour window, an IP has more than 5 blocks at our proxy every 5 minutes for the entire 4 hours. At any point within the 4 hour frame, if the hit count drops below 5 in 5 minutes, I don't want to be alerted.
The search belows gives me the hit count by IP in 5 minute blocks but I'm not sure how to get alerted if a unique IP constantly has 5 hits every 5 minutes throughout the 4 hours.
host="proxy1" status="blocked" | timechart span=5m count by IP
Try this:
host="proxy1" status="blocked" | timechart span=5m count by IP | untable _time IP count | stats min(count) as min_count by IP | where min_count >= 5
Try this:
host="proxy1" status="blocked" | timechart span=5m count by IP | untable _time IP count | stats min(count) as min_count by IP | where min_count >= 5