XQL For Silent Log Source

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

XQL For Silent Log Source

L0 Member

below is the query so far but what we are trying to do is get a silent log source detection. For example, one of the log source names has not sent a log in x number of hours then alert. Any suggestions?


dataset = panw_ngfw_traffic_raw | fields log_source_name | dedup log_source_name

1 accepted solution

Accepted Solutions

Thank you for that info, that really helped a lot and below is the full query and if you want to limit per log source you can define limit at the end for example | limit 2 etc

 

dataset = panw_ngfw_traffic_raw

| fields log_source_name, _insert_time, _time

| comp max(_time) as offlinesince by log_source_name

| alter ct = current_time()

| alter diff_in_hour = timestamp_diff(ct, offlinesince, "HOUR")

| filter diff_in_hour > 0

View solution in original post

2 REPLIES 2

L2 Linker

I need to test but I think it can be something like below.

dataset = panw_ngfw_traffic_raw | fields log_source_name,_timestamp

|comp max(_timestamp) as offlinesince by log_source_name

|Filter  timestamp_diff(currenttime(),offlinesince,"HOUR")> x //x being the hours you mentioned.

 

 

Correct the syntaxes wherever necessary using the xql reference.

 

Thank you for that info, that really helped a lot and below is the full query and if you want to limit per log source you can define limit at the end for example | limit 2 etc

 

dataset = panw_ngfw_traffic_raw

| fields log_source_name, _insert_time, _time

| comp max(_time) as offlinesince by log_source_name

| alter ct = current_time()

| alter diff_in_hour = timestamp_diff(ct, offlinesince, "HOUR")

| filter diff_in_hour > 0

  • 1 accepted solution
  • 457 Views
  • 2 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!