Hi,
I am trying to build a rule that triggers when at least 3 events are seen with the same Source IP and (3) different Process Names. I am using the following test definition: when at least 3 events are seen with the same Source IP and different Process Name in 30 minutes, however, this triggers when there are 3 events with the same source IP and more than 1 different Process Names. I found an old thread on the same subject, which suggests adding an AQL filter as the last test definition with the following (adapted for my use-case): UNIQUECOUNT("Process Name")>=3, but when add it I get an error saying aggregate functions are not allowed in WHERE clauses.

Does anyone have any suggestions how to overcome this?

------------------------------
Viorel Chicu
------------------------------

Hi! Don't use AQL, keep it simple: split the rule in two by using a rule to count one condition and generate an event, then count this second event generated by the CRE.

------------------------------
Marco Zanchi
------------------------------

Hi Marco
Thank you for your reply. I have been wrecking my brain on how to achieve this via two rules, but have not been successful, I can't find (workout) what test definitions to use in order to achieve an alert for events where there are at least three different process names and the source IP is the same. Any advice would be most appreciated.

------------------------------
Viorel Chicu
------------------------------

Original Message:
Sent: Fri January 27, 2023 05:05 AM
From: Marco Zanchi
Subject: Custom Rule Question

Hi! Don't use AQL, keep it simple: split the rule in two by using a rule to count one condition and generate an event, then count this second event generated by the CRE.

------------------------------
Marco Zanchi
------------------------------