Alert when Log Source last event received is < 24 Hours

[Shinej]

Hello All,

Im trying create an alert when when Log Source last event received is < 24 Hours OR a dashboard which displays log Source which is not sending logs since last 24 hours.

I was able to build a dashboard with latest event received timestamp but not able to compare the timestamp. like -- timestamp < 24 Hours

The idea is to identify the Log Stoppages - the hosts not sending logs to SIEM -

any ideas on achieving this is appreciated.

Thanks

[stephenb (Stephen Brown)]

Hi @Shinej

There is a pretty cool way to do this using a latest transform with the host.name

Take a look at this this particular example is it about users

But I actually did this same thing for last log from each host.

Basically the latest transform just keeps the latest log from each host.

Then you can just check / alert which host have not reported in in the last 24 hours.

Detecting inactive users in Active Directory

I think a latest transform could perhaps be a good solution. I Did this for host not users But same concept. We wanted to see what hosts had not sent logs lately. Basically if you do a latest transform using a user ID as the unique identifier and the timestamp as the latest time then you will see the user that has not logged in in the last day or two days or a week etc. Most your users will have logged in recently, but you'll see the tail of the users that have not. It's actually could be pr…