I need to create an Event Correlation rule that performs a sequence that group by for a value and meantime count for another value.
My scope is:
sequence by user.name with maxspan=10m and count county >= 2
I couldn't find any way to do it. Could anyone help me?
Hi there ,
If I understand your use case correctly, you are not able to due this in a single rule, but you should be able to achieve it leveraging building block rules (BBR) and a threshold rule.
You would need to do this in a few parts:
- ruleA: create a threshold rule where
county > 2 with a lookback (
from) of 10m (as a BBR)
- ruleB: create a sequence with
sequence1, sequence2 (as a BBR)
- create a sequence rule alerting on the 2 previous rule alerts:
sequence by user.name with maxspan=10m
[any where event.kind == "signal" and kibana.alert.rule.rule_id == "<ruleA.rule_id>"]
[any where event.kind == "signal" and kibana.alert.rule.rule_id == "<ruleB.rule_id>"]
You may have to play with timing of the 2
maxspans and the
lookback to get it right, but this should achieve what you are trying to do. You also don't necessarily need to use BBR's for the 2 interim rules, but if you don't, then you will get 3 alerts every time this fully completes.
Hope this helps
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.