EQL match event A only if event B does not occur within maxspan

Elastic Stack Elasticsearch
1

Hi,

My question is similar to https://discuss.elastic.co/t/creating-alert-when-event-didnt-occur/282195, which was never really resolved. I'm looking to see if there are any other suggestions how to handle this. Basically we need something like this:

sequence with maxspan=5m
  [ event A ]
  [ maxspan expires ]
until [ event B ]

For those familiar with SEC, this would be like the PairWithWindow rule where the first action is executed if the second event is not seen within the time window.

Is this possible?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.