unique_count correlation

[wlamy]

I have several usecases where I need a unique occurences of field values, for instance to detect account spraying:

action: correlation
name: spray_attack
type: unique_count
group-by: status
unique: user
timespan: 5m
condition:
	gte: 4

Would NOT trigger:

user:"alice", status:failed logon
user:"alice", status:failed logon
user:"bob", status:failed logon
user:"bob", status:failed logon

Would trigger:

user:"alice", status:"failed logon"
user:"bob", status:"failed logon"
user:"charlie", status:"failed logon"
user:"david", status:"failed logon"

So as you can see, my proposition is a new type of "unique_count" (or any better suited term) as well as a new field to design the "unique:" values field.

Thoughts?

W/

[thomaspatzke]

This is the meaning of the value count correlation.

[wlamy]

So "The condition finally defines how many values must occur to generate a search hit." means how many different values for a single field, correct? That would make sense and indeed address my needs. Thanks and sorry for me being confused!

[thomaspatzke]

Exactly!