graylog-plugin-correlation-count
graylog-plugin-correlation-count copied to clipboard
airbus-cyber
Alert condition plugin for Graylog to perform correlation
Events from stream1 should occured **strictly** before/after those from stream2. If they happen at exactly the same time (milisecond) it will not trigger an Event. It should be documented in...
Actually the plugin has 2 threshold types (more/less than), 2 streams and multiple time conditions (any/before/after). It makes the code complex. Regarding the time conditions we could only keep before...
The actual algorithm is a double "for" loop to browse all events to check if conditions are satisfied at this specific timestamp. It consumes many resources, I think it could...
According to the [Graylog upgrade guide](https://go2docs.graylog.org/current/upgrading_graylog/upgrading_to_graylog_6.0.x.htm), all plugins must be adjusted to work with Graylog 6.0. Incompatible plugins will break the server startup. Will the plugin be adjusted to work...
Hi, I’m trying to use the Correlation Count plugin (built for Graylog 6.1) with Graylog 6.3.3 and I’m getting compilation errors: AbsoluteRange class no longer exists in Graylog 6.3.3. validate(UserContext)...
Metadata
Owner
Metadata
Alert condition plugin for Graylog to perform correlation