Hi,
I want to create alert for Windows Security Event Log
and when the event matches EventID (custom) is any of 4625
and when at least 3 events are seen with the same Username in 24 hour(s).
Here is my watcher.
{
"trigger": {
"schedule": {
"interval": "20s"
}
},
"input": {
"search": {
"request": {
"search_type": "query_then_fetch",
"indices": [
"siem-os-*"
],
"rest_total_hits_as_int": true,
"body": {
"size": 1,
"query": {
"bool": {
"must": [
{
"term": {
"EventID": {
"value": "4625"
}
}
},
{
"exists": {
"field": "EventID"
}
}
],
"filter": {
"range": {
"@timestamp": {
"gte": "now-24h"
}
}
}
}
},
"aggs": {
"user_name": {
"terms": {
"field": "UserName.keyword"
}
}
}
}
}
}
},
"condition": {
"compare": {
"ctx.payload.hits.total": {
"gte": 0
}
}
},
"actions": {
"index_1": {
"index": {
"index": "alert-for-4625"
}
}
}
}
Kindly help me with writing condition.
Kindly help,
Tahseen