Alerting

Anyway to query past fired alert base on certain field?

totaro
Explorer

Hi would like to check if this is possible:
Lets say i have an 2 alert:
alert A: check auth log for locked out in past 24 hour by ip
alert B: check netflow log for upload > 10gb in past 24 hour by ip

Is it possible for splunk to tell me x.x.x.x had trigger alert A on certain date, and trigger alert B on certain date when i query x.x.x.x?

The goal is to tie past alert that had fired to certain field, be it an IP or an account name
So i can easily check how 'suspicious' a user is based on his past triggered alert

0 Karma

lakshman239
SplunkTrust
SplunkTrust

Yes possible. I assume both the alert details are stored in an index. Then you can create a search which can look for one or more specific fields and can bring in matching alerts - you would need to widen the search window.

0 Karma

totaro
Explorer

Hi what index would that be? i cant seem to find an index that show alert fired. the closest would be Activity > Triggered alerts but those are not searchable

0 Karma

jacobpevans
Motivator

index=_audit action=alert_fired

Only alerts that have a Trigger Action of "Add to Triggered Alerts" will show up here. However, there are no results from the alert displayed in this index unless you track down the search by the sid field. However, it is still possible. Here's an overview

Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...