Notify when multiple event soccured in 15 with same srcip,dstip and different dsports

Elastic Stack Kibana
1

Hi,
@timroes
Thanks in advance.

I want to filter all the events with same source ip and destination ip's with different port numbers in a time interval of 15minutes.
srcip,dstip,dstport are the field names.

Can you please help me to achieve this.
Please let me know any of the options like visualization charts,searches or alert methods.

2

You could create a scripted field that could then be easily filtered on.

doc['srcip'].value == doc['dstip'].value && doc['srcport'].value != doc['dstport'].value

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.