Re: event correlation on metron

2017-10-17 Thread Youzha
quot;source.type == 'activedirectory' and event.type == >>>>> 'failed_login'" >>>>> "init": { "count": 0 }, >>>>> "update": { "count" : "count + 1" }, >>>>>

Re: event correlation on metron

2017-10-17 Thread Simon Elliston Ball
>>>>>> "onlyif": "source.type == 'activedirectory' and event.type == >>>>>>>> 'failed_login'" >>>>>>>> "init": { "count": 0 }, >>>>>>>> "update": { "count" : "count + 1" }, >>>>>>>> "result": "count" >>>>>>>> } >>>>>>>> >>>>>>>> You can find an introduction and more information on using the >>>>>>>> Profiler below. >>>>>>>> * >>>>>>>> https://github.com/apache/metron/tree/master/metron-analytics/metron-profiler >>>>>>>> * https://www.slideshare.net/secret/GFBf2RTXBG35PB >>>>>>>> >>>>>>>> Best of luck >>>>>>>> >>>>>>>>> On Tue, Oct 17, 2017 at 4:51 AM, tkg_cangkul <yuza.ras...@gmail.com> >>>>>>>>> wrote: >>>>>>>>> for example, >>>>>>>>> >>>>>>>>> i wanna try to correlate between logs. >>>>>>>>> how many times user A have login failed and how many times user A >>>>>>>>> have login succeed. include detail IP, timestamp etc. >>>>>>>>> is this possible to do with metron? >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>>> On 17/10/17 02:56, James Sirota wrote: >>>>>>>>>> What specifically are you looking to correlate? Can you talk a >>>>>>>>>> little more about your use case? >>>>>>>>>> >>>>>>>>>> 16.10.2017, 02:23, "tkg_cangkul" <yuza.ras...@gmail.com>: >>>>>>>>>>> hi, >>>>>>>>>>> >>>>>>>>>>> anyone could explain me about event correlation using apache metron? >>>>>>>>>>> does metron support event correlation? >>>>>>>>>>> >>>>>>>>>>> Pls Advice >>>>>>>>>> --- >>>>>>>>>> Thank you, >>>>>>>>>> >>>>>>>>>> James Sirota >>>>>>>>>> PMC- Apache Metron >>>>>>>>>> jsirota AT apache DOT org >>>>>>

Re: event correlation on metron

2017-10-17 Thread Youzha
quot;result": "count" >>>> } >>>> >>>> >>>> You can find an introduction and more information on using the Profiler >>>> below. >>>> * >>>> https://github.com/apache/metron/tree/master/metron-analyt

Re: event correlation on metron

2017-10-17 Thread Simon Elliston Ball
t;: "count" >>>>>> } >>>>>> >>>>>> You can find an introduction and more information on using the Profiler >>>>>> below. >>>>>> * >>>>>> https://github.com/apache/metron/tree/master/m

Re: event correlation on metron

2017-10-17 Thread ed d
; user@metron.apache.org Subject: Re: event correlation on metron So, There are several options parsing the data and enriching. 1. A native parser ( java ), which you have noticed is not there 2. An instance of the GROK parser, with GROK rules that parser the input 3. If it is CSV an instance of the CSV

Re: event correlation on metron

2017-10-17 Thread Otto Fowler
>>> login succeed. include detail IP, timestamp etc. >>> is this possible to do with metron? >>> >>> >>> >>> >>> On 17/10/17 02:56, James Sirota wrote: >>> >>>> What specifically are you looking to correlate? Can you talk a little >>>> more about your use case? >>>> >>>> 16.10.2017, 02:23, "tkg_cangkul" <yuza.ras...@gmail.com>: >>>> >>>>> hi, >>>>> >>>>> anyone could explain me about event correlation using apache metron? >>>>> does metron support event correlation? >>>>> >>>>> Pls Advice >>>> >>>> --- >>>> Thank you, >>>> >>>> James Sirota >>>> PMC- Apache Metron >>>> jsirota AT apache DOT org >>> >>> >

Re: event correlation on metron

2017-10-17 Thread Youzha
try to correlate between logs. >>> how many times user A have login failed and how many times user A have >>> login succeed. include detail IP, timestamp etc. >>> is this possible to do with metron? >>> >>> >>> >>> >>> On 17

Re: event correlation on metron

2017-10-17 Thread Laurens Vets
t; > i wanna try to correlate between logs. > how many times user A have login failed and how many times user A have login > succeed. include detail IP, timestamp etc. > is this possible to do with metron? > > On 17/10/17 02:56, James Sirota wrote: > What specifically a

Fwd: event correlation on metron

2017-10-17 Thread Youzha
-- Forwarded message - From: Youzha <yuza.ras...@gmail.com> Date: Tue, 17 Oct 2017 at 22.53 Subject: Re: event correlation on metron To: <user@metron.apache.org> is it possible to ingest other logs like /var/log/secure for example to be new telemetry on metro

Re: event correlation on metron

2017-10-17 Thread Youzha
t;> how many times user A have login failed and how many times user A have >> login succeed. include detail IP, timestamp etc. >> is this possible to do with metron? >> >> >> >> >> On 17/10/17 02:56, James Sirota wrote: >> >>> What specifi

Re: event correlation on metron

2017-10-17 Thread Nick Allen
s Sirota wrote: > >> What specifically are you looking to correlate? Can you talk a little >> more about your use case? >> >> 16.10.2017, 02:23, "tkg_cangkul" <yuza.ras...@gmail.com>: >> >>> hi, >>> >>> anyone could explain me about event correlation using apache metron? >>> does metron support event correlation? >>> >>> Pls Advice >>> >> --- >> Thank you, >> >> James Sirota >> PMC- Apache Metron >> jsirota AT apache DOT org >> > >

Re: event correlation on metron

2017-10-17 Thread tkg_cangkul
to correlate? Can you talk a little more about your use case? 16.10.2017, 02:23, "tkg_cangkul" <yuza.ras...@gmail.com>: hi, anyone could explain me about event correlation using apache metron? does metron support event correlation? Pls Advice --- Thank you, James Si

Re: event correlation on metron

2017-10-16 Thread James Sirota
What specifically are you looking to correlate? Can you talk a little more about your use case? 16.10.2017, 02:23, "tkg_cangkul" <yuza.ras...@gmail.com>: > hi, > > anyone could explain me about event correlation using apache metron? > does metron support event

event correlation on metron

2017-10-16 Thread tkg_cangkul
hi, anyone could explain me about event correlation using apache metron? does metron support event correlation? Pls Advice