Pipeline alert aggregated

im wondering if i can create a match in pipeline that match if a failed login event id occurs 5 times in 5 min AND one success login then create a match
i know u can do it in enterprise version but cant use it here…

like this

(event_id:4625 AND keywords:“Audit Failure”)

Threshold = 6 matches within 5min)


(event_id:4624 AND keywords:“Audit Success”)

Threshold = 1 match within 5min)

Alarm will be created when there will be at least 6 failed logon attempts and one successful logon within 5 min time span

that is only doable with the correlation engine … what is enterprise feature.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.