Detecting inactivity

Devo Source

1. Drag a Devo Source unit to the canvas and open its configuration options by double-clicking it.

2. Add a Name to the unit (in this example, we called it DevoSource), and specify the Query that receives the events of the required data source. In this example, we're using the following query:

   from siem.logtrust.web.activity
     where isnotnull(serverHost)
     group every 5s by serverHost, username
     every 5s
   select last(eventdate) as lasteventdate

   

3. Leave the rest of the settings as default and click Apply to save the configuration.

   If you have problems saving this unit or running the Flow, switch off the Check DB configuration option.

Map

1. Drag a Map unit to the canvas and link the stall port of the Devo Source unit to the in port of this unit, as follows:

   

2. Then, open the configuration options of the unit by double-clicking it. In the General tab, add a Name to the unit (in this example, we called it FillGaps), and leave the Language as default (Groovy).

3. In the Fields to add tab, you must add 4 different fields that will define our fake events. Add the following fields by clicking the + button:

   Field 1 Field 2 Field 3 Field 4 The serverHost column of our fake events Field name - serverHost Type - String Expression - "stall_source" The username column of our fake events. Field name - username Type - String Expression - "stall_username" This fields contains a value that will be used to identify the fake events and discard them later. Field name - value Type - String Expression - "stall_source__stall_username" The lasteventdate column of our fake events. Field name - lasteventdate Type - java.lang.Object Expression - eventdate

4. Click Apply to save the configuration.

Lookup

1. Drag a Lookup unit to the canvas and link it to the Devo Source and Map units as follows:
   • Link the init port of the Devo Source unit to the end port of the Lookup unit. We need this link to unblock the lookup since it starts blocked by default.
   • Link the data port of the Devo Source unit to the update port of the Lookup unit. This will update the content of the lookup when new data from our source arrives.
   • Finally, link the out port of the Map unit to the update port of the Lookup unit. As explained before, this will activate the Lookup unit when the data source does not send any data.

   

2. Then, open the configuration options of the unit by double-clicking it and enter the following values:
   • Name - Add a name to the unit. In this example, we're calling it HoleChecker.
   • Key field(s) -  Input fields that contain key values. In this case, we need the serverHost and username fields.
   • Lookup key field(s) - Name of the lookup fields to be matched with the key fields. In this case, we are using the input query fields serverHost and username.
   • Lookup value field - The values of this field will be added to the lookup when there's a match. In this case, choose the column lasteventdate.
   • Expiration time - Set the required expiration time. When there are no new events containing a specific key value (in this example, server host + username values) after this period finishes, an event will be sent through the expired port of this unit. In this case, we're setting it to 30000 milliseconds.
   • Lookup timestamp field - Timestamp to be used for the events that come from the update port of the unit. Choose the lasteventdate field.
   • Timestamp field - Timestamp to be used for the events that come from the in port of the unit. Choose the lasteventdate field.
3. Click Apply to save the configuration.

Filter

1. Drag a Filter unit to the canvas and link the expired port of the Lookup unit to the in port of this unit, as follows:

   

2. Then, open the configuration options of the unit by double-clicking it. Add a Name to the unit (in this example, we called it FilterStallValue), leave the Language as default (Groovy) and enter the following expression in the Predicate field. This expression will filter out all the fake events we used to notify the Lookup about total inactivity periods:

   value != "stall_source__stall_username"

   

3. Click Apply to save the configuration.

Map

1. Drag a Map unit to the canvas and link the out port of the Filter unit to the in port of this unit, as follows:

   

2. Then, open the configuration options of the unit by double-clicking it. In the General tab, add a Name to the unit (in this example, we called it ValueSeparator), and leave the Language as default (Groovy).

   

3. In the Fields to add tab, you must add 2 different fields by clicking the + button:

   Field 1 Field 2 This field will contain the values of the serverHost column. Field name - serverHost Type - String Expression - key[0] This field will contain the values of the username column. Field name - username Type - String Expression - key[1]

   

4. In the Fields to remove tab, enter the key and value fields.

   

5. Click Apply to save the configuration.

Email Sink

1. Drag an Email Sink unit to the canvas and link the out port of the Map unit to the in port of this unit, as follows:

   

2. Then, open the configuration options of the unit by double-clicking it. In the General tab, add a Name to the unit (in this example, we called it InactivityMail), add a Subject for the emails to be sent (in this example, Inactivity Warning).

   Then, in the Message field, you must enter the text to be sent in the mails. For this example, we added the following (where username and serverHost are variable fields that will be automatically replaced by the corresponding values)

   The user %%{username} has been inactive for the last 10 seconds in the server %%{serverHost}

   

3. Then, click the To recipients tab and add as many email addresses as required by clicking the + icon.

   

4. Click Apply to save the configuration.