Hi, Version: ELK 7.13 Need to generate a single alert for all events with unique event.action feild values in last 30minute. Can someone please let me know which rule type I can use here? Also please share if you have any sample. I have tried following without success. Threshold rule Detectio…

One alert for all unique event.action from all events in last 30mins

system (system) Closed September 20, 2021, 3:50pm 3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Single behavior generates several alerts SIEM	4	1211	October 19, 2021
Watch - Unique count Elasticsearch elastic-stack-alerting	6	1705	April 12, 2018
How do I create an alert to for a specific behavior of a unique field value Elasticsearch elastic-stack-alerting	2	749	July 3, 2018
Unique Field in the watcher action Elasticsearch elastic-stack-alerting	2	1190	June 19, 2019
Aggregation in Watcher Elasticsearch elastic-stack-alerting	3	1727	July 6, 2017