},
"condition": {
"script": {
"source": """
def offenders = [];
for (def reporting_ip: ctx.payload.aggregations.reporting_ip.buckets) {
for (def user: reporting_ip.user.buckets) {
for (def compass_tenantId: user.compass_tenantId.buckets) {
if (compass_tenantId.doc_count >= 1 ) {
offenders.add([
'reporting_ip': reporting_ip.key,
'user': user.key,
'compass_tenantId': compass_tenantId.key,
'attempts': compass_tenantId.doc_count,
'events': compass_tenantId.events,
'incident_name': 'ACCOUNT_LOCKOUT_DOMAIN',
'status_open' : 'open',
'description' : 'Accound Locked: Domain',
'incident_severity' : '10',
'conditions' : 'DomainAcctLockout, 10mins'
]);
}
}
}
}
ctx.payload.offenders = offenders;
return offenders.size() > 0;
""",
"lang": "painless"
}
},
"metadata": {
"window_period": "3h"
},
"result": {
"execution_time": "2018-02-13T12:50:20.936Z",
"execution_duration": 4,
"input": {
"type": "search",
"status": "success",
"payload": {
"_shards": {
"total": 5,
"failed": 0,
"successful": 5,
"skipped": 0
},
"hits": {
"hits": [],
"total": 0,
"max_score": 0
},
"took": 3,
"timed_out": false,
"offenders": [],
"aggregations": {
"reporting_ip": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": []
}
}
},
"search": {
"request": {
"search_type": "query_then_fetch",
"indices": [
"tid*"
],
"types": [],
"body": {
"size": 0,
"query": {
"bool": {
"filter": [
{
"range": {
"@timestamp": {
"gte": "now-3h"
}
}
},
{
"term": {
"event_type_group": "domain_account_locked"
}
}
]
}
},
"aggs": {
"reporting_ip": {
"terms": {
"field": "reporting_ip.keyword"
},
"aggs": {
"user": {
"terms": {
"field": "user.keyword"
},
"aggs": {
"compass_tenantId": {
"terms": {
"field": "compass_tenantId.keyword"
},
"aggs": {
"events": {
"top_hits": {
"size": 100,
"_source": [
"@timestamp",
"event_type",
"reporting_ip",
"source_ip",
"user",
"computer",
"win_logon_type",
"raw_event_log"
]
}
}
}
}
}
}
}
}
}
}
}
}
},
"condition": {
"type": "script",
"status": "success",
"met": false
},
"actions": []
},
"messages": []
},
"sort": [
1518526220936
]