1. Guardsix Servicedesk
  2. Community
  3. SIEM - Searching & Analytics

distinct_count and followed by Issue while fetching Azure AD sign in logs

Avatar
Follow
1

Office365 logs are sending duplicate events. So the generic usecase doesnt really work

[10 label=User label=Login label=Fail having same user] as s1 followed by [label=User label=Login label=Successful] as s2 on s1.user = s2.user


[col_type=office365 label=User label=Login label=Fail | chart distinct_count(id) as CNT by user | filter CNT>2] as s1 followed by [col_type=office365 label=User label=Login label=Successful] as s2 on s1.user = s2.user | chart count() by s2.log_ts,s2.user

Here "id" represents request id in azure AD, which is unique and thats what i want.

  1. Even if there isn't any output from s1, still I get some result from total query
  2. Also, i dont exactly get the followed by event, i get all success events in the timeframe

Share This Post:

1 comment

Date Votes
0
Avatar
Jean Kanellakopoulos

I have the exact same issue with "followed by" on an SSH login rule, where I check for N failed logins followed by a successful one.
The first stream (failed) aggregates and makes the condition check. The second just checks for a single success event.
The aggregation yields a single aggregated row. The second stream yields one success event that took place AFTER the max_ts of the aggregated first stream and 11 success events that were before max_ts.
I still get 12 aggregated result rows through "followed by".

Please sign in to leave a comment.