# Alerting based on event correlation with multiple lines

**URL:** <https://community.graylog.org/t/alerting-based-on-event-correlation-with-multiple-lines/12450>\
**Category:** Graylog Central (peer support)\
**Created:** [October 19, 2019, 8:30am UTC](https://community.graylog.org/t/alerting-based-on-event-correlation-with-multiple-lines/12450 "2019-10-19T08:30:21Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![menardorama](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/menardorama/32/5197_2.png) [@menardorama](https://community.graylog.org/u/menardorama)\
**Post date:** [October 19, 2019, 8:30am UTC](https://community.graylog.org/t/alerting-based-on-event-correlation-with-multiple-lines/12450/1 "2019-10-19T08:30:21Z")

</div>

Hi,

We began to use graylog recently and found that is very useful, really great tool.

One of the point interesting for us is event correlation and alerting.

We want to be able to correlate webmail connection for the same user based on ip src.

We want to use bigip logs for that, but the information can only be obtained when following this manual process

1.Search for new connection (Search filter : “New session”) and get sessionid and username fields  
2.Search with this sessionid to find the field ip\_src  
3.Alert if ip geo location are different from a 10 minute period

The idea is to identify if accounts are being hacked.

Is it possible ?

Thanks

---

<div class="post-metadata">

**Author:** ![shoothub](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/shoothub/32/6412_2.png) [@shoothub](https://community.graylog.org/u/shoothub)\
**Post date:** [October 21, 2019, 8:01am UTC](https://community.graylog.org/t/alerting-based-on-event-correlation-with-multiple-lines/12450/2 "2019-10-21T08:01:43Z")

</div>

If you want to use correlation, you need Enterprise license, which is free if you have lower than 5GB logs of day:  
[https://docs.graylog.org/en/3.1/pages/streams/alerts.html](https://docs.graylog.org/en/3.1/pages/streams/alerts.html)

Video how to install Enterprise license:

> **[Enterprise License Install | Graylog Videos](https://www.graylog.org/videos/enterprise-license-install)**
>
> Let's find out how to install Graylog Enterprise License edition.

Form to get Enterprise license key:

> **[Download & Install Graylog](https://www.graylog.org/downloads#free-enterprise)**
>
> Download and install Graylog Open Source for free!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [November 4, 2019, 8:01am UTC](https://community.graylog.org/t/alerting-based-on-event-correlation-with-multiple-lines/12450/3 "2019-11-04T08:01:48Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.