Understanding the Statistical Lists

Statistical lists are lists that are linked to a condition.

For example, Brute Force Host, Port Scanners etc. You can use these lists when creating correlation rules.



Statistics are used when repetitive incidents are expected to occur for a specific period of time. For example, Multiple Login Failures (@@LoginFailure: mini query of login failure on any device) occur 5 times in six minutes.

Description: In terms of definition, we need to specify a name for the list.

Type: Statistical

Severity: You can decide with this severity selection how much important the list for you.

Context: You can tag the object, which enters this list, as Suspicious, Victim or Attacker for future events.

Query: As query information, you will use the @@LogonFaiure mini query because you want to use unsuccessful login operations.

Group Column: You will determine the column information to be grouped. You set it to Source.UserName.

Values Column: You will fill in the value information to be grouped. Likewise, you set it as Source.UserName.

Criteria: You choose Value Count as a criteria for how many times users will log in after a failed login attempt.

Trigger Level: If seven (7) more unsuccessful login attempts occur, users will enter the list.

Check events in last: This is where you can set the seconds to check again after seven hundred twenty (720) seconds before the same event occurs.

Update Period: You will give you the information on how long you will update for that event, ignoring the check events in the last option.

Purge Period: The number of seconds after which the information to retrieve from the list will be given. By default, it is specified as three thousand (3000) seconds.

Index Events: If you tick the Index Events option, the list will be written to the Logsign Unified Security Operations Platform Index system.

Then you use the Save button to save your settings.

After creating your alarm list, you will have to create a rule based on the alerting. In this way Logsign Unified Security Operations Platform will start to produce the alarms you need. You will perform our next step of creating alarms.

Using the Logsign Unified Security Operations Platform WEB interface, click on the Alerts -> Alert Rules tab, then click on the New Alert Rule tab in the top right corner of the page.

Was this article helpful?
0 out of 0 found this helpful

Articles in this section

Become a Certified Logsign User/Administrator
Sign-up for Logsign Academy and take the courses to learn about Logsign USO Platform in detail. Enjoy the courses, and get your badges and certificates. In these courses, you'll learn how to use Logsign in your work and add value to your career.
Visit Our Blog
Our Logsign USO Platform illustrate our expertise. So do the blog. Through our blog posts, deepen your knowledge on various SecOps topics or get updated about important news & modern approaches for cybersecurity. Get into the habit of reading valuable information provided by Logsign. Be a step ahead.