Alerting

Suggestions to write an alert if event B occurs without event A?

sarahnazzar
Explorer

Hello Splunkers!

I have an event A from source A and event B from source B.

I need an alert when event B occurs without event A... Is this feasible? Could you please help me or post some suggestions?

Thanks in Advance!

Labels (1)
0 Karma

to4kawa
Ultra Champion
(index=A source=A event=A) OR (index=B source=B event=B)
| eval common=coalesce(eventA,eventB)
| stats count(eval(source="A")) as A count(eval(source="B")) as B by common
| where B > 0 AND A = 0
0 Karma

sarahnazzar
Explorer

Thanks for the response @to4kawa !

In my case, event A and event B are the raw events, I don't have any fields extracted over there..

0 Karma

to4kawa
Ultra Champion

well, why don't you provide sample logs?

0 Karma

sarahnazzar
Explorer

PFB sample logs ,

EventA : Thu May 13 2020 00:15:05 mailsv1 sshd[4351]: Failed password for invalid user guest from 86.212.199.60 port 3771 ssh2

Event B : Thu May 13 2020 01:16:05 mailsv1 sshd[46748]: Received disconnect from 86.212.199.60: disconnected by user

0 Karma

to4kawa
Ultra Champion

two events have same ip address.
Let's extract and collect them.

0 Karma

sarahnazzar
Explorer

Hi.. in some cases the IPs are not same.. we need to filter using the string "Failed password" and "Received disconnect" and frame the query..

Thanks for your response @to4kawa!

0 Karma

to4kawa
Ultra Champion
...
| rex "(?<status>Failed password|Received disconnect)"
| reverse
| streamstats dc(status) as status_count
| where status_count =1 AND status="Received disconnect"

when event count > 0 , fire alert.

0 Karma

sarahnazzar
Explorer

Thanks for the response @to4kawa
I tried the using the query but its fetching event 2 even if event 1 occurred.

0 Karma

Yulworm
Engager

Hi @sarahnazzar , did you manage to get this working? Your comment implies that it does not work and I have not been able to adapt it to my, very similar, context

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

@Yulworm Please can you open a new providing more detail on your usecase?

0 Karma

to4kawa
Ultra Champion

If you are correct, then the event_count should be 2.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...