Correlating events from multiple streams

Graylog Central (peer support)
, ,
1

Hi everyone,

I’m using the free version of Graylog 6.3.3.

Is there a way to create an alert that triggers only if both of these log events occur (from different streams) within 5 minutes?

  • Stream AD → winlogbeat_event_code:4625

  • Stream FA → reason:sslvpn_login_permission_denied

Right now, I’m using this query:

(winlogbeat_event_code:4625 AND winlogbeat_winlog_event_data_AuthenticationPackageName:MICROSOFT_AUTHENTICATION_PACKAGE_V1_0) OR reason:sslvpn_login_permission_denied

However, this also triggers when only one of the conditions is met, and I’d like it to fire only when both happen close together in time.

Any ideas or best practices to achieve this in the free version?

Thanks!

2

Howdy and welcome! :partying_face:

There may be some way to do this outside of Graylog Enterprise, but my knowledge about solving this problem is specific to the paid version of Graylog (full disclosure: as an employee). Graylog Enterprise does provide this correlation engine capability.

3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.