Hello all! I'd like to create a Rule based on the EQL query that will trigger an alert only once per user. For example: The input list of logs is user1 ip1 user1 ip1 user2 ip2 user5 ip5 user4 ip4 user4 ip4 user20 ip20 user1 ip1 user20 ip20 And I want to create alerts based on that logs …

Hey there @yzaritskyi ! :wave: So if you only want one per grouping of user.name / process.name, you might want to try using a Threshold Rule ala: [image] You may want to include the dns name in the Group by depending on how you want your alerts broken apart. Let me know if that works for you! …

EQL query to alert 1 alert per each user

Elastic Security SIEM

yzaritskyi (Yaroslav Zaritskyi) August 8, 2023, 1:15pm 3

Thank you! You helped me a lot! It works exactly how I wanted.

1 Like

Topic		Replies	Views
SIEM custom rule to generate an alert if multiple users attempts with same source IP or same mac address Elastic Security elastic-stack-alerting	3	969	December 30, 2021
Single behavior generates several alerts SIEM	4	1213	October 19, 2021
EQL - Alert on different values for the same field in a sequence Elastic Security	7	1168	November 4, 2022
SIEM Threshold - unique values SIEM	6	1464	September 29, 2020
EQL correlation query help look up value within a message Elastic Security	6	530	February 7, 2022

EQL query to alert 1 alert per each user

Related topics