Alerting

Alert on count of email sender is seen 5 times within 1 hour

AyeDefo
Engager

I'm trying to create a search to output a list of unique senders where that sender has generated a DLP log 5 times or more within a 24 hour period.
Ideally this should not count the same email more than once if the single email triggers multiple policy hits in the policy field.

What I have so far:

index=dlp eventtype=symantec_dlp_alert
| bucket span=24h  _time
| stats count by _time sender
| where count > 5
| sort -count

But the output does not seem right. Any guidance would be much appreciated.

0 Karma
1 Solution

woodcock
Esteemed Legend

I don't have these logs in front of me but you should have some kind of unique identifier for the email ( subject, mid, etc.) so let's assume your data has mid and do it like this:

 index=dlp eventtype=symantec_dlp_alert
 | bucket span=24h _time
 | stats dc(mid) BY _time sender
 | search count > 5
 | sort 0 - count

View solution in original post

woodcock
Esteemed Legend

I don't have these logs in front of me but you should have some kind of unique identifier for the email ( subject, mid, etc.) so let's assume your data has mid and do it like this:

 index=dlp eventtype=symantec_dlp_alert
 | bucket span=24h _time
 | stats dc(mid) BY _time sender
 | search count > 5
 | sort 0 - count

gfreitas
Builder

Try to replace the stats count by _time sender for stats dc(sender) as count by _time
The dc command is distinct count of values for that field

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...