Skip to main content

Threshold Rules

(1) Define Rule​

  1. Source: Leave default index patterns as-is or select the specific data source(s) that the query will be ran againstto make the rule more efficient.

  2. Custom query: Leave the default *:* query, or input a query that will filter for the specific logs that you want to alert on.

  3. Group by: Select fields to group by - fields are joined together with a logical AND

  4. Count: Select a field to check cardinality against

    tip

    This example would alert if a specific user.name had at least 5 different source.ip/destination.ip pairs (such as network logons) within the scheduled time period.

  5. Optional - To test the rule logic, you can use the Rule Preview feature on the top of the page.

  6. Optional - Timeline Template: Adding a timeline template will create an alert timeline with its search fields dynamically populated with fields from the alert. This is only effective if the timeline template's fields match the fields that will be present in the alerting log.

  7. Continue to the Rule Finalization section to complete the rule