Hi everyone, I have set up a Kibana alert security detection rule which creates an alert for all my incoming third-party system alerts (Suricata) and send each one of them to my SIRP using webhook. I have many alerts with the same event_type (eg. SSH connection attempts) but with different destina…

Aggregate alerts by a specific field and send a summary through an action for each field value encountered

system (system) Closed December 6, 2023, 10:53am 2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
One alert for all unique event.action from all events in last 30mins Elasticsearch elastic-stack-alerting , detection-rules	2	490	September 20, 2021
Aggregation in Watcher Elasticsearch elastic-stack-alerting	3	1727	July 6, 2017
How to create a rule with aggregation SIEM elastic-stack-security	5	2688	May 4, 2021
Parsing complex bucket aggregations in watcher Elasticsearch	3	790	May 12, 2017
Aggregation of incoming events on common fields for SIEM usecase SIEM	1	304	May 20, 2020