Help creating rule

[ngms17]

I need to create a rule that triggers an alert when a X value of "suricata.eve.event.kind: flow" is reached in a given timeframe. The catch here is that the alert must trigger in relation to a certain destination.ip that may not always be the same.

Example, if i have 400 flows to destination IP x.x.x.x in 2 space of 2 minutes i want to trigger the alert.

Thanks in advance

[jertel]

Sounds like you need a frequency rule with a query_key: dest.ip setting: https://elastalert2.readthedocs.io/en/latest/ruletypes.html#frequency