Hi there,
I have set up an advanced Watch and it triggers upon 3 or more of the same TargetUserName with the EventID:4625, basically that alerts on any user failing to logon 3 times in 3 minutes. Here is my body section of the email callback:
"body": {
"text": "The user: {{ctx.payload.TargetUserName}} failed to logon: {{ctx.payload.hits.total}} times."
}
The second ctx call works and I am shown the amount of times the TargetUserName field appeard, but as for the: {{ctx.payload.TargetUserName}} no data shows, I presume I am doing something wrong here?
Cheers,
G
Below is the entire Watch, just in case anyone needs it.
{
"trigger": {
"schedule": {
"interval": "1m"
}
},
"input": {
"search": {
"request": {
"search_type": "query_then_fetch",
"indices": [
"*"
],
"types": [],
"body": {
"size": 0,
"query": {
"bool": {
"filter": [
{
"range": {
"@timestamp": {
"gte": "now-5m",
"lte": "now"
}
}
},
{
"term": {
"EventID": "4625"
}
}
]
}
},
"aggs": {
"User": {
"terms": {
"field": "TargetUserName.keyword"
}
}
}
}
}
}
},
"condition": {
"compare": {
"ctx.payload.aggregations.User.buckets.0.doc_count": {
"gte": 3
}
}
},
"actions": {
"email_admin": {
"throttle_period_in_millis": 50000,
"email": {
"profile": "standard",
"to": [
"xxxxxxxxxxxx@mycompany.com"
],
"subject": "Warning: Multiple Failed Logons",
"body": {
"text": "The user: {{ctx.payload.TargetUserName}} failed to logon: {{ctx.payload.hits.total}} times."
}
}
}
}
}