I would like to know if it’s possible or if you guys have a trick to create alerts grouping by one field and counting distinctly another field.
For example for failed authentication events:
Cases
An user are trying to authenticate to many different hosts, so I would like a rule like I could group this single user and count how many unique hosts he is trying this.
An user are trying to authenticate from many different IP
such is possible, you first need to create one event that has the username as key. as second field available the IP and the target.
now you can run a second event runner on the given events that can aggregate on the username grouped by targets … with the enterprise plugins you could correlate that you want to get a notification if the IP of that user is changing or similar.
First I need create an event that will catch the failed authentication events and add custom fields on it, the username as key and a target field with the source and destination IP.
you define the second event taking the event stream and search for the keys. you can work with the created events like with other messages from streams.
with the correlation engine you select the kind of events …
