HI all,
We currently have our vpn logs going into graylog and have created some notifications and alerts around that data. Once of the ones we want to create is an alarm that will trigger if a users source IP changes substantially. For example, user foo logs in mostly as
foo/192.168.1.1
Suddenly this changes to:
foo/10.92.1.1
how would I go about create an alert that could be triggered by that scenario?
This is possible but unfortunately I don’t know how you set up you environment for us to proceed.
This would require how you are ingesting logs, configuration, etc…
Maybe this post could help
EDIT: Those are completely two different networks 192.168.1.1 and 10.92.1.1 . I personally never had a node switch networks even if I had DHCP enabled.
