No recepcion de eventos en Datacet

[H.PovedaMartinez]

Good morning



Question, is it possible to create a rule to detect when an XDR datacet is not ingesting events?

[jmazzeo]

Hi @H.PovedaMartinez, thanks for reaching us using the Live Community.

I have this example in my lab for Okta SSO, but you can modify it to work with your dataset. This is a Correlation Rule:

dataset = xdr_data 
| bin _time span = 1h timeshift = 946684800
| comp count() by _time
| join type = left conflict_strategy = left
    (dataset = metrics_source | filter _vendor = "Okta" and _product = "Sso" | bin _time span = 1h timeshift = 946684800)
    as metrics metrics._time = _time
| filter total_event_count = null
| alter description = "No data ingested within a 1h timespan for Okta"
| fields _time, description

If this post answers your question, please mark it as the solution.