Alert when an event is not followed by another

Elastic Security SIEM
7

Hi,

Thank you for your answer. I got around the problem by using an external monitoring tool (nagios plug-in).

Via a request on the API, I get the last events with my two events as filter (the OK and the NOK). If the last event is the 4202 I put the check in "critical", if it is the 4204 I put it in "OK".
on the supervision tool I can refine the check delays, and the triggering of the critical state.

Thanks.

1 Like