Skip to main content

Custom Use Case

  • February 14, 2025
  • 3 replies
  • 4 views

Forum|alt.badge.img+7

Hi Team,
So there is  a requirement.

Can we have a rule in SecOps SIEM that will trigger whenever there is a log stoppage from that particular log source (product & vendor) for a period of 1 or 2 hours?

3 replies

TomAtGoogle
Staff
Forum|alt.badge.img+5
  • Staff
  • February 14, 2025

Here's a way to pull the latest event and see how old it is.  

rule LatestEventComparison {
 meta:
    description = "Detects if the latest event from a datasource is older than a specified threshold."
    author = "Your Name"
    version = "1.0"
 events:
    $event.metadata.product_event_type = "<YOUR_DATASOURCE_NAME>" // Replace with your datasource
    $event.metadata.event_timestamp.seconds = max($event.metadata.event_timestamp.seconds)
    $current_time = now()
    $time_difference = $current_time.seconds - $event.metadata.event_timestamp.seconds  
    $threshold = 3600 // Example: 1 hour threshold (adjust as needed)

 condition:
    $time_difference > $threshold
 outcome:
    $outcome.event = $event
    $outcome.current_time = $current_time
    $outcome.time_difference = $time_difference
    $outcome.threshold = $threshold
    $outcome.message = "Latest event from <YOUR_DATASOURCE_NAME> is older than the threshold."
}


Forum|alt.badge.img+7
  • Author
  • Bronze 2
  • February 15, 2025

This is throwing an error : 

parsing: error with token: ")"
unexpected token
line: 9
column: 25-26


cmorris
Staff
Forum|alt.badge.img+10
  • Staff
  • February 15, 2025