HI all,

I am trying to create a threshold rule using an AQL saved search, the saved search is retrieving the data as its supposed, but when I tries to create a threshold rule I receive the following error on the rule finish page:

"The accumulated data view cannot be created because your saved search contains HAVING clause."

The query looks like this:

SELECT "userName" AS 'Username', logsourcename(logSourceId) AS 'Log Source', COUNT(*) AS 'Count'
from events where ( "creEventList"='100063' AND Username IS NOT NULL)
GROUP BY "userName", logSourceId
HAVING COUNT(*) > '9.0' order by "Count"

Appreciate your help,

------------------------------
Haitham
------------------------------

Hello @Haitham Aletiewi

From my understanding, the threshold in the anomaly rule will act as the "Having" part of your AQL.
Therefore, you must save the search without the Having part.

Then, when you will go through the anomaly/threshold rule wizard, you will be able to specify the threshold, i.e. COUNT > 9
​​


Hope that helps,

Cheers.

------------------------------
Arnaud Chemla
Head of security consulting
Abakus Securité
------------------------------

Hallo Haitan,

Use the formatting function LONG() for 'count' then the comparision works with unformatted numbers.

SELECT "userName" AS 'Username', logsourcename(logSourceId) AS 'Log Source', LONG(COUNT(*)) AS 'Count'
from events where Username IS NOT NULL
GROUP BY "userName", logSourceId
HAVING COUNT(*) > 3 order by "Count"

Kind regards

Jürgen

------------------------------
Jürgen Wörner
------------------------------

Thanks @Arnaud Chemla and @Jürgen Wörner, I have combined both response and I got my rule is working fine now.

Best regards, ​​​​​

------------------------------
Haitham
------------------------------