I have the following search (MySearch), which is tied to an alert.
index=exchange_smtp Context=authenticated OR EHLO | iplocation ipaddress | search Country != "United States" | transaction Session keepevicted=true | Search Context=authenticated | eval merged=user.Country | lookup user_location username as merged | search NOT target=* | table Data,Session,ipaddress,user,Country
I have a lookup file called smtpforeignip.csv with a search that populates and updates this file with ipaddress,user,Country.
I want to modify MySearch to do a comparison against smtpforeignip.csv. If there is a matching ipaddress I do not want the alert to trigger. I ONLY want the alert to trigger when there is a non-matching ipaddress.
Try like this. The NOT subsearch will exclude all those foreign ip address from the main result itself.
index=exchange_smtp Context=authenticated OR EHLO NOT [| inputlookup smtpforeignip.csv | table ipaddress ]| iplocation ipaddress | search Country != "United States" | transaction Session keepevicted=true | Search Context=authenticated | eval merged=user.Country | lookup user_location username as merged | search NOT target=* | table Data,Session,ipaddress,user,Country
Try like this. The NOT subsearch will exclude all those foreign ip address from the main result itself.
index=exchange_smtp Context=authenticated OR EHLO NOT [| inputlookup smtpforeignip.csv | table ipaddress ]| iplocation ipaddress | search Country != "United States" | transaction Session keepevicted=true | Search Context=authenticated | eval merged=user.Country | lookup user_location username as merged | search NOT target=* | table Data,Session,ipaddress,user,Country