ES|QL - span

Elastic Security Endpoint Security
1

Hi i create a new topic as a advice of your team:

I want to create a rule that will detect the upload of a large amount of data from my network. The rule works as I want, except that I have to run it every minute to group the data into minute blocks for each domain. My question is how to set it up so that I only need to run the rule once every 12 hours, with the upload data being calculated in minute blocks.

Here is my current query:
from logs-*
| WHERE (CIDR_MATCH(source.ip, "10.0.0.0/8") OR CIDR_MATCH(source.ip, "172.16.0.0/12") OR CIDR_MATCH(source.ip, "192.168.0.0/16")) and url.domain is not null and @timestamp >= now() - 60seconds
| stats upload = sum(source.bytes) by url.domain, source.ip
| where upload >= 52428800

eg in splunk exist command span so something like that

2

Hello Marek,

Could something like this work for you(untested)?

from logs-*
| WHERE (CIDR_MATCH(source.ip, "10.0.0.0/8") OR CIDR_MATCH(source.ip, "172.16.0.0/12") OR CIDR_MATCH(source.ip, "192.168.0.0/16")) and url.domain is not null and @timestamp >= now() - 12hours
| stats upload = sum(source.bytes) by url.domain, source.ip, minute = BUCKET(@timestamp, 1 minute)
| where upload >= 52428800

This will also group by the @timestamp splitting it into a histogramm of 1 minute intervals.

Best regards
Wolfram

1 Like
3

HI, no that didnt work because Unknown function [BUCKET]

4

What version of the stack do you have? BUCKET became available with 8.14. If you have an earlier version, you may try using AUTO_BUCKET: ES|QL functions and operators | Elasticsearch Guide [8.11] | Elastic

5

v 8.13.2 so i try do ask colleque to upgrade to 8x14 and try the bucket, thx

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.