Feedback:

transaction

Use the transaction operator to group events together based on different grouping methods. Each group is considered as a transaction.

Syntax

|transaction <field list> [combolimit] [startpattern] [endpattern] [events] [span] [pause] [outputlimit]

<field list>

Comma-separated list of fields to define unique file combinations for the 1st-level grouping.
[combolimit = <num>]

(Optional) Maximum number of combinations based on the field list.
[startpattern = <string>], [endpattern = <string>]

(Optional) Use the specified patterns to specify the start and end of what defines a transaction. You can specify matching patterns using AQL where operator evaluation expressions, as shown in the following examples:

  • sourcetype startswith 'ms_d', or

  • example_field contains_ci 'CVE-'

[events = <num>]

(Optional) Use event count to define what a transaction is.
[span= [<integer>][s,h,m]]

(Optional) Use timespan to define what a transaction is.
[pause= [<integer>][s,h,m]]

(Optional) Use time pause to separate transactions.
[outputlimit = <num>]

(Optional) Maximum output per the combination of specified fields.

Usage

The 1st-level grouping enumerates all possible value combinations based on the given <field list> (for example, src_ip, dest_ip) with combolimit as the maximum number of combinations, after which output is truncated.

The 2nd-level grouping (a transaction) will be applied based on one of the following sub-grouping methods:

[startpattern, [endpattern]

Define the transaction based on start/end patterns.
[events]

Define the transaction based on the number of consecutive events.
[span]

Define the transaction based on the timespan of consecutive events.
[pause]

Define the transaction based on maximum time pause between consecutive events.

Examples

Example 1: Group events by specified fields and create transactions with a five-minute time span.

Copy 
|where sourcetype='ms_defender' and src is not null and src_ip is not null | transaction src,src_ip span=5M combolimit=4

Example 2: Create transactions for events with matching source IP addresses and source values.

Copy 
|where sourcetype='ms_defender' and src_ip is not null | transaction src_ip,src events=10

Example 3: Groups Fortigate Firewall events into transactions by source interface and IP within five minute windows, capping each transaction at four events.

Copy 
ocsf | where metadata.product.name='Fortigate Firewall' and src_endpoint.interface_name is not null and src_endpoint.ip is not null | transaction src_endpoint.interface_name, src_endpoint.ip span=5M combolimit=4

Example 4: Creates an inline session dataset for two users, converts millisecond timestamps to readable times, then groups events into transactions per user bounded by login/logout pairs, capping each session at 5 events or 120 seconds with a 30-second pause threshold.

Copy 
ocsf 
| makeresults format='csv' input='event_meta_id,event_time_ms,user_name,activity_name,src_ip,dest\n1,1677485890000,userA,login,10.0.0.1,app\n2,1677485905000,userA,view,10.0.0.1,app\n3,1677485920000,userA,logout,10.0.0.1,app\n4,1677485935000,userA,view,10.0.0.1,app\n5,1677485950000,userA,login,10.0.0.1,app\n6,1677485965000,userA,view,10.0.0.1,app\n7,1677485980000,userA,logout,10.0.0.1,app\n8,1677485995000,userA,view,10.0.0.1,app\n9,1677485890000,userB,view,10.0.0.2,app' 
| calc event_time=from_unixtime(event_time_ms) 
| transaction user_name startpattern=(activity_name='login') endpattern=(activity_name='logout') events=5 span=120s pause=30s format='transactions'