# EQL correlation query help look up value within a message **URL:** \ **Category:** Elastic Security\ **Created:** [January 4, 2022, 7:21pm UTC](https://discuss.elastic.co/t/eql-correlation-query-help-look-up-value-within-a-message/293474 "2022-01-04T19:21:02Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![krabel1ze](https://avatars.discourse-cdn.com/v4/letter/k/dbc845/32.png) [@krabel1ze](https://discuss.elastic.co/u/krabel1ze)\ **Post date:** [January 4, 2022, 7:21pm UTC](https://discuss.elastic.co/t/eql-correlation-query-help-look-up-value-within-a-message/293474/1 "2022-01-04T19:21:02Z")
Hello! I want to created an Okta SSO authentication alert in [Elastic.co](http://Elastic.co) based on geo-ip information. The query in LOGIC terms should look something like this: If client.user.id {133713371337} event.outcome == "success" with source.ip {85.145.234.50} and if client.user.id {111122223333} event.outcome == "success" with source.ip of client.user.id {133713371337, in this example: 85.145.234.50} How should I convert this to an EQL correlation query? So far I have been only able to construct a simple query like this one: ![Screenshot 2022-01-04 at 20.07.49](https://us1.discourse-cdn.com/elastic/original/3X/6/8/682b60dbc4851bf19a65fe2f3b76dad421628954.png) I am stuck on the methodology and video's/tutorials/manuals did not help me yet. Can someone please help me in the right direction? Cheers! ---
**Author:** ![jamesspi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jamesspi/32/24479_2.png) [@jamesspi](https://discuss.elastic.co/u/jamesspi)\ **Post date:** [January 5, 2022, 1:20pm UTC](https://discuss.elastic.co/t/eql-correlation-query-help-look-up-value-within-a-message/293474/2 "2022-01-05T13:20:00Z")
Hey @krabel1ze! Just want to make sure I've understood - do you want to check if two different users are logging in from the same source IP? In that case, you'll want to use threshold based alerting, rather than EQL. Something like this: ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/7/870609aa0c73ae839edab2d477f94e46d5cd1096.png) James ---
**Author:** ![krabel1ze](https://avatars.discourse-cdn.com/v4/letter/k/dbc845/32.png) [@krabel1ze](https://discuss.elastic.co/u/krabel1ze)\ **Post date:** [January 10, 2022, 11:48am UTC](https://discuss.elastic.co/t/eql-correlation-query-help-look-up-value-within-a-message/293474/3 "2022-01-10T11:48:32Z")
Hi James and others, Thank you. I can configure a threshold alert as a more generic rule. In other words, I can alert on any user who logged in from the same IP. However, how would I configure this rule for two specific users (please note my initial start post)? How can I alert on if user with ID/name AAA uses the same IP as user with ID/name BBB? ---
**Author:** ![jamesspi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jamesspi/32/24479_2.png) [@jamesspi](https://discuss.elastic.co/u/jamesspi)\ **Post date:** [January 10, 2022, 12:15pm UTC](https://discuss.elastic.co/t/eql-correlation-query-help-look-up-value-within-a-message/293474/4 "2022-01-10T12:15:30Z")
Hey @krabel1ze , Apologies, didn't realise it was specific to those users. In that case, EQL should work well. Right now, we support looking for a specific sequence of events, adding a rolling time window if you need. You'll want something like: ```auto sequence by source.ip [authentication where client.user.id:"AAAAA" and event.outcome:"success"] [authentication where client.user.id:"BBBBB" and event.outcome:"success"] ``` The "by" statement acts a join key here. This will only fire/match if the source IP address is the same for both events. James ---
**Author:** ![krabel1ze](https://avatars.discourse-cdn.com/v4/letter/k/dbc845/32.png) [@krabel1ze](https://discuss.elastic.co/u/krabel1ze)\ **Post date:** [January 10, 2022, 1:33pm UTC](https://discuss.elastic.co/t/eql-correlation-query-help-look-up-value-within-a-message/293474/5 "2022-01-10T13:33:23Z")
Thank you James! This works. Final question though, how would this EQL query look like if I want to alert on user(s) which _does not_ have the same IP and event.outcome : "success" (one user which _doesn't_ match with the other)? Reason: I want to copy paste this EQL query in "Timelines" for hunting purposes. Cheers! ---
**Author:** ![jamesspi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jamesspi/32/24479_2.png) [@jamesspi](https://discuss.elastic.co/u/jamesspi)\ **Post date:** [January 10, 2022, 1:59pm UTC](https://discuss.elastic.co/t/eql-correlation-query-help-look-up-value-within-a-message/293474/6 "2022-01-10T13:59:08Z")
Unfortunately, we don't support negative matches across EQL sequences just yet. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 7, 2022, 1:59pm UTC](https://discuss.elastic.co/t/eql-correlation-query-help-look-up-value-within-a-message/293474/7 "2022-02-07T13:59:31Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.