# How to approach file rename alerting (Sysmon)

**URL:** <https://community.graylog.org/t/how-to-approach-file-rename-alerting-sysmon/20872>\
**Category:** Graylog Central (peer support)\
**Tags:** pipeline-rules, route-to-streampl\
**Created:** [August 12, 2021, 7:30am UTC](https://community.graylog.org/t/how-to-approach-file-rename-alerting-sysmon/20872 "2021-08-12T07:30:47Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![CypherBit](https://avatars.discourse-cdn.com/v4/letter/c/e9c0ed/32.png) [@CypherBit](https://community.graylog.org/u/CypherBit)\
**Post date:** [August 12, 2021, 7:30am UTC](https://community.graylog.org/t/how-to-approach-file-rename-alerting-sysmon/20872/1 "2021-08-12T07:30:47Z")

</div>

I’d like to be alerted when one field doesn’t contain the value of a different field, but don’t know how to approach it at all.

For example if Image: field does not contain what OriginalFileName contains I’d like to have an alert, dashboard showing these results.  
This is based on: [https://twitter.com/cyb3rops/status/1411454217512960003?s=20](https://twitter.com/cyb3rops/status/1411454217512960003?s=20)

In this example OriginalFileName would be CertUtil.exe, but Image: wouldn’t contain CertUtil.exe.

I’m thinking PipeLines would be the best fit, but I don’t know how to write such a query, can anyone help me out?

---

<div class="post-metadata">

**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\
**Post date:** [August 12, 2021, 10:26pm UTC](https://community.graylog.org/t/how-to-approach-file-rename-alerting-sysmon/20872/2 "2021-08-12T22:26:24Z")

</div>

Hello,  
The link below have many examples you can use. I’m still learning how to write pipeline/s and I get most of my information here when I need to write one.

> **[graylog-plugin-pipeline-processor/plugin/src/test/resources/org/graylog/plugins/...](https://github.com/Graylog2/graylog-plugin-pipeline-processor/tree/master/plugin/src/test/resources/org/graylog/plugins/pipelineprocessor)**
>
> master/plugin/src/test/resources/org/graylog/plugins/pipelineprocessor

Hope that helps

EDIT:  
I tried to create these pipelines rules for you. If anything I maybe on the right track. 😉

@shoothub is more skilled at this then I am.

```auto
rule "Fields that DO match"
when
	has_field("my_field") AND contains(to_string($message.my_field),"CertUtil.exe") == has_field("some_other_field") AND contains(to_string($message.some_other_field),"bob")
then
	set_field("new_field","true");
end

```

```auto
rule "Fields that DONT match"
when
	has_field("my_field") AND contains(to_string($message.my_field),"CertUtil.exe") == has_field("some_other_field") AND contains(to_string($message.does_not_exist),"bob")
then
	set_field("new_field","alert");
end

```

```auto
Rule "route to stream"
when
    has_field("new_field")AND contains(to_string($message.new_field),"alert")
then
    route_to_stream(id:"5d8acba383d72e04cba96317");
end

```

---

<div class="post-metadata">

**Author:** ![shoothub](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/shoothub/32/6412_2.png) [@shoothub](https://community.graylog.org/u/shoothub)\
**Post date:** [August 13, 2021, 8:02am UTC](https://community.graylog.org/t/how-to-approach-file-rename-alerting-sysmon/20872/3 "2021-08-13T08:02:04Z")

</div>

Hi @gsmith,  
I would suggest to use rather examples from master [graylog2-server](https://github.com/Graylog2/graylog2-server) repo, not obsoleted plugin:

> **[graylog2-server/graylog2-server/src/test/resources/org/graylog/plugins/pipelinep...](https://github.com/Graylog2/graylog2-server/tree/master/graylog2-server/src/test/resources/org/graylog/plugins/pipelineprocessor)**
>
> master/graylog2-server/src/test/resources/org/graylog/plugins/pipelineprocessor

---

<div class="post-metadata">

**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\
**Post date:** [August 13, 2021, 9:18pm UTC](https://community.graylog.org/t/how-to-approach-file-rename-alerting-sysmon/20872/4 "2021-08-13T21:18:48Z")

</div>

Oh nice , Thanks man 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [August 27, 2021, 9:18pm UTC](https://community.graylog.org/t/how-to-approach-file-rename-alerting-sysmon/20872/5 "2021-08-27T21:18:49Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.