Alert agreggation with content

Graylog Central (peer support)
1

Hi,

I want to configure an alert based on agreggation message and content condition.

Log format:

%source% %source_ip% %message%

Example logs:

<sourceA> <source_ip1> <message1>
<sourceA> <source_ip2> <message1>
<sourceB> <source_ip1> <message1>
<sourceC> <source_ip1> <message1>
<sourceF> <source_ip1> <message3>

Stream “test” rules: (OK)

  • if message1 match, index in this stream

Now I want to create an alert based on “message count alert condition” with “search query” option (Graylog 2.5):

Alert “Alert_streamTest” condition wanted:

If the log trigger the 5 entries Threshold in 1 minute Time Range with the same source_ip value field, create alert.

Is it possible with search query to check the value on field “source_ip” to match if the value is the same ?

If is not possible with this solution, is it possible with graylog to create this type of alert with other method ?

Thanks !!

2

Maybe take a look at this alert plugin and see if it fulfills your use case: https://github.com/airbus-cyber/graylog-plugin-aggregation-count

3

Thanks, I check this :slight_smile:
But if others have an solution …

4

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.