topic Re: Need help in extraction in Security

Need help in extraction

neeltiwari — Mon, 13 Dec 2021 17:43:36 GMT

index=* host=* rule=corp_deny_all_to_untrust NOT dest_port=4242 | table src_ip dest_ip transport dest_port application .. I am able to get the source IP with this query .. how can I get the AWS instance name? there is no such interesting field as AWS instance name .. kindly help

Re: Need help in extraction

ITWhisperer — Mon, 13 Dec 2021 17:58:27 GMT

What data do you have in your raw events?

Re: Need help in extraction

neeltiwari — Mon, 13 Dec 2021 18:17:36 GMT

@ITWhisperer Thanks of the response , please find the raw data below.

<14>Dec 9 12:08:05 uw2-fw-02 1,2021/12/09 12:08:05,007255000201562,TRAFFIC,drop,2560,2021/12/09 12:08:05,172.30.197.3,172.217.14.227,0.0.0.0,0.0.0.0,corp_deny_all_to_untrust,,,not-applicable,vsys1,c3d_security_gwlbe,untrust,ethernet1/1.1,,c3d_logging_profile,2021/12/09 12:08:05,0,1,63629,443,0,0,0x0,udp,deny,0,0,0,1,2021/12/09 12:08:04,0,any,0,41289869,0x0,172.16.0.0-172.31.255.255,United States,0,1,0,policy-deny,0,0,0,0,,uw2-fw-02,from-policy,,,0,,0,,N/A,0,0,0,0,486b8130-2024-494d-998f-d38d1d99aeb2,0,0,,,,,,,,0.0.0.0,,,,,,,,,,,,,,,,,,,,,,,,,,,2021-12-09T12:08:05.153-08:00,,

Re: Need help in extraction

ITWhisperer — Mon, 13 Dec 2021 18:25:31 GMT

Which part of the raw event is the AWS instance id you are trying to extract?