# Aggs in DSL **URL:** \ **Category:** Elastic Security\ **Created:** [November 11, 2023, 10:36am UTC](https://discuss.elastic.co/t/aggs-in-dsl/346910 "2023-11-11T10:36:46Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Sayantica\_Ganguly](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sayantica_ganguly/32/126488_2.png) [@Sayantica\_Ganguly](https://discuss.elastic.co/u/Sayantica_Ganguly)\ **Post date:** [November 11, 2023, 10:36am UTC](https://discuss.elastic.co/t/aggs-in-dsl/346910/1 "2023-11-11T10:36:46Z")
when I create a new rule in Custom query with DSL for the query Login Authentication Condition 1: Count of failed login attempts for the same user account is greater than or equal to 5 within the last 2 minutes. Condition 2: The failed login attempts originate from at least 3 different IP addresses. Time Window: Last 15 minutes I give POST /\_all /\_search { "size": 0, "query": { "bool": { "filter": [ { "range": { "@timestamp": { "gte": "now-15m/m" } } }, { "term": { "event.code ": "4625" } } ] } }, "aggs": { "users": { "terms": { "field": "user.name ", "min\_doc\_count": 5 }, "aggs": { "unique\_ips": { "cardinality": { "field": "source.ip" } } } } } } It give me positive value result in Dev Tools but I put the query in filter DSL ,it does not take any aggs . How to figure out this ---
**Author:** ![AngelaChuang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/angelachuang/32/49719_2.png) [@AngelaChuang](https://discuss.elastic.co/u/AngelaChuang)\ **Post date:** [November 13, 2023, 10:16am UTC](https://discuss.elastic.co/t/aggs-in-dsl/346910/2 "2023-11-13T10:16:23Z")
Hello, After reading your use case, Threshold rule might be better than custom query rule: > [**Threshold**](https://www.elastic.co/guide/en/security/current/rules-ui-create.html#create-threshold-rule): Searches the defined indices and creates a detections alert when the number of times the specified field’s value is present and meets the threshold during a single execution. When multiple values meet the threshold, an alert is generated for each value. > **[About detection rules | Elastic Security Solution \[8.11\] | Elastic](https://www.elastic.co/guide/en/security/current/about-rules.html#rule-types)** Here are some more guidance of how to create a Threshold rule. > **[Create a detection rule | Elastic Security Solution \[8.11\] | Elastic](https://www.elastic.co/guide/en/security/current/rules-ui-create.html#create-threshold-rule)** Hope these help. Thank you. ---
**Author:** ![Sayantica\_Ganguly](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sayantica_ganguly/32/126488_2.png) [@Sayantica\_Ganguly](https://discuss.elastic.co/u/Sayantica_Ganguly)\ **Post date:** [November 14, 2023, 5:59am UTC](https://discuss.elastic.co/t/aggs-in-dsl/346910/3 "2023-11-14T05:59:39Z")
Hi, Thanks for the reply. Already done but I give KQL with event failure and group by single user and count related ip. If I have to put time duration with 2 min ,how to put ? I cant figure out because in event.duration if I give the value , wouldn't take as it does not understand the event start. So, if you resolve this problem for me ,it will be highly helpful. ---
**Author:** ![AngelaChuang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/angelachuang/32/49719_2.png) [@AngelaChuang](https://discuss.elastic.co/u/AngelaChuang)\ **Post date:** [November 14, 2023, 10:46am UTC](https://discuss.elastic.co/t/aggs-in-dsl/346910/4 "2023-11-14T10:46:13Z")
You could consider organising the data before creating a rule: I'd probably use ingest pipeline to create a **duration** field if you have start and end time in each document. > **[Ingest pipelines | Elasticsearch Guide \[8.11\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html)** Group by single user or ip could be done by transform > **[Transform examples | Elasticsearch Guide \[8.11\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/transform-examples.html)** ---
**Author:** ![Sayantica\_Ganguly](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sayantica_ganguly/32/126488_2.png) [@Sayantica\_Ganguly](https://discuss.elastic.co/u/Sayantica_Ganguly)\ **Post date:** [November 14, 2023, 12:26pm UTC](https://discuss.elastic.co/t/aggs-in-dsl/346910/5 "2023-11-14T12:26:13Z")
is there any other way to give event.duration in KQL , So it can work ---
**Author:** ![AngelaChuang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/angelachuang/32/49719_2.png) [@AngelaChuang](https://discuss.elastic.co/u/AngelaChuang)\ **Post date:** [November 14, 2023, 2:12pm UTC](https://discuss.elastic.co/t/aggs-in-dsl/346910/6 "2023-11-14T14:12:18Z")
If you've got event.duration field in the documents already. According to ECS, it's the difference in nanoseconds between event.start and event.end. Would filter with event.duration not working in this cases? > Duration of the event in nanoseconds. > > If `event.start` and `event.end` are known this value should be the difference between the end and start time. > > type: long > **[Event Fields | Elastic Common Schema (ECS) Reference \[8.11\] | Elastic](https://www.elastic.co/guide/en/ecs/current/ecs-event.html#field-event-duration)** ---
**Author:** ![Sayantica\_Ganguly](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sayantica_ganguly/32/126488_2.png) [@Sayantica\_Ganguly](https://discuss.elastic.co/u/Sayantica_Ganguly)\ **Post date:** [November 16, 2023, 7:32am UTC](https://discuss.elastic.co/t/aggs-in-dsl/346910/7 "2023-11-16T07:32:06Z")
If I specify event.start and event.end it take time with date if i have to create a rule totrigger an alert it must not be a specific date only the duration ie 2 min when i put event.duration : 120000 it does not take and give no logs ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 14, 2023, 7:33am UTC](https://discuss.elastic.co/t/aggs-in-dsl/346910/8 "2023-12-14T07:33:00Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.