Alerting

Detecting endpoint change in a specific event with an alert

jcunningham_con
Explorer

Looking for assistance with creating an email alert when an endpoint changes in logs.

We want to avoid multiple emails going out every 15 minutes and only send the email alert when the switch happens.

The alert would be searching every 15 minutes. Thinking that the best way to do this is come up with a search that only returns the specific event in question. If we find two different endpoints (field value) for the 15 minute window, then we know a switch has occurred.

From here am looking for assistance. How to write the query to detect which endpoint we started with and what we switched to. Thinking that we can do something like the following to get timestamp for endpointA and endpointB events. Then see which one is greater than the other. Then conditional statement to determine what the source and destination endpoints are.

... | eval time_a = case(expression to determine if it's endpointA, _time) | eval time_b = case(expression to determine if it's endpointB, _time)

Any help would be greatly appreciated.

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Don't overcomplicate your life. If there is more than one endpoint in a period, then it changed.

 your search that gets all events in the time range with field `myendpoint`
| stats values(myendpoint) as myendpoint
| where mvcount(myendpoint) > 1

...or, if you really want to know what it changed from, and what it changed to...

 your search that gets all events in the time range with field `myendpoint`
| stats values(myendpoint) as myendpoint, earliest(myendpoint) as firstendpoint, latest(myendpoint) as lastendpoint
| where mvcount(myendpoint) > 1
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...