Hi,
I have the correlation rule-Substantial Increase In Events enabled but I just want to fine tune this rule based on our environment.
I dont want this rule to fire when there is a match in the signature that is defined in the lookuptable "substantialincreasesignature.csv".
But as soon as I run this it is throwing an error,can you check out this for me.
| tstats allow_old_summaries=true count,values(IDS_Attacks.tag) as orig_tag from datamodel=Intrusion_Detection by IDS_Attacks.signature| search IDS_Attacks.signature!=* [inputlookup substantialincreasesignature.csv]
| tstats allow_old_summaries=true count,values(IDS_Attacks.tag) as orig_tag from datamodel=Intrusion_Detection by IDS_Attacks.signature as signatures AND NOT[|inputlookup substantialincreasesignature|fields signature]
Both search I tried but no results:(
Regards,
↧