You could pull that out in a report in zeppelin easily enough, but to do it real-time we would need to add some sort of state table and a triggered check of that state, unless you say wanted to alert only on logout (I’m assuming you don’t want to wait for the logout, but alerts after some fixed duration or better some anomalous duration?)
Is that the sort of use case? Simon On Thu, 16 May 2019 at 03:59, tkg_cangkul <yuza.ras...@gmail.com> wrote: > Hi, > > Does metron support to do detection an unusual login duration? > > For example. > IP A login for 3 days without logout. then metron will give some alert > to us. > > If this possible, how to do that? > Pls help. > > > Best Regards, > > Tkg_cangkul > > -- -- simon elliston ball @sireb
