Help with ESA rule
I'm trying to write an ESA rule to trigger when the customer gets 10 error 500 and 10 error 400 for a Web Service in 5 minutes.
the thing here is, the customer wants the rule to trigger the alert regardless of how the events arrives, for example:
2 x 400 - 2 x 500 - 8 x 400 - 8 x 500 must match and trigger the alert
10 x 400 - 10 x 500 also must match and tirgger
1 x 500 - 10 x 400 - 9 x500 also must match and trigger
I'm totally lost how to write this alert
any help will be very very appreciated.
How about this one?:
SELECT window(*) FROM Event(
device_class = 'Web Logs'
result_code LIKE '4%'
result_code LIKE '5%'
GROUP BY ip_dst
HAVING COUNT(result_code) >= 20
OUTPUT FIRST EVERY 300 seconds;
But be careful because I am just grouping by ip.dst and not by ip.src, so it can trigger a lot of alerts in certain scenarios. You should group by ip.src as well or increase the suppression time (the OUTPUT FIRST clause).
Thank you so much for helping with this rule.
The sintax of your rule seem to work if I don't care about the amount of 4xx or 5xx errors. For example, your rule seems to match if there are 20 errors 4xx, 10 4xx and 10 5xx or 20 5xx.
What I'm looking for is a rule that matches if I have:
5 error 5xx
10 errors 4xx, no matter how they are ingested by the ESA engine....
and 2 5xx
I don't know if I'm clear with this.
once again, thank you so much for your help!