Execute some rule but in order

Graylog Central (peer support)
1

Hi folks,

I’m starting in Graylog and I want tell that is great this tools. I’m trying do some things like execute rule but in order but I can’t do It.
So I want create this rule for example:

  1. One Stream for fails logon events
  2. One Stream for succes logon eventos

This idea is for:

  1. Aggrupation for same user
  2. Theses rule must execute in order, firts the one Stream and second Stream then.
  3. Alert if this condition is ok

I don’t see the way do It, sorry but I’m new in Graylog.

Thank you

2

with the current release it is not possible - but 3.1 will move into this direction and make it possible.

ETA - August this year

3

Great Jan! Thank you for reply!!

4

This plugin is exactly what you need: https://github.com/airbus-cyber/graylog-plugin-correlation-count

5

Hi Frantz

Yes, i’ve seen the plugin but i think this plugin not works for order. Do you test this plugin for “order” sequential (one, then two, etc…)???

Regards

6

This plugin works for order.
If it doesn’t please open an issue: https://github.com/airbus-cyber/graylog-plugin-correlation-count/issues
You can easily do “one then two”.

If you want “one then two then three” you need to add another plugin (https://github.com/airbus-cyber/graylog-plugin-logging-alert) which generates a log for “one then two”, so you can use this genrated log to do “then three”.

7

I’ll check that Frantz.

8

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.