Custom Alert Configure

[zakirpcs]

Custom alert configure.

I want to create a custom alert as like follows:

For example a user failed logon (ssh) attempt happen 5 times within one minutes then a custom alert will be generated as per below format:

1. User Name
2. Source IP (Client Terminal IP)
3. Server IP
4. Number for failed attempt.

My testing environment is as follows:

• OS: AlmaLinux release 8.5
• Opendistro Kibana Version: 7.10.2
• Opendistro Elasticsearch Version: 7.10.2

Is there anyone who can help me on this.

Thanks in advance.

Zakir Hossain