topic Re: Queries for multiple tasks in Security

Help with Search for multiple tasks

Cyberguru — Thu, 26 Jan 2023 00:02:11 GMT

Hey Splunk Community!

Working on a dashboard ( For Incident Response) in splunk but need some assistance initially with queries on the following in Splunk:

Computer or host showing if malicious
Logon info for other machines that a user has logged in for the ay
IP address of machine, Location or Country, Is it a VM, and Laptop
Active Directory info on user
Remote machine name - to find out what machine was used to remote into the Server on the last incident

Need this soon, would be appreciated.

Thanks Very much!

Re: Queries for multiple tasks

gcusello — Wed, 25 Jan 2023 15:59:38 GMT

Hi @Cyberguru,

there isn't a general answer to your question because the searches depend on the data you have: e.g. if you speak of malicious host, this depends on the Antivirus or WAF or the IPS/IDS you're using.

So start from the technologies you're collecting logs, then see in Splunkbase (apps.splunk.com) if there's an App (usually there is!) that gives you the dashboards you need.

In addition I hint to install and see the Splunk Security Essentials App (https://splunkbase.splunk.com/app/3435) that contains many security searches and guides you in the data analysis.

Ciao.

Giuseppe

Re: Queries for multiple tasks

Cyberguru — Wed, 25 Jan 2023 16:03:28 GMT

Just need -malicious host for Symantec AV for e.g.

Re: Queries for multiple tasks

gcusello — Wed, 25 Jan 2023 16:09:34 GMT

Hi @Cyberguru,

see in Splunkbase (apps.splunk.com) the Add-on to collect data and the App to display data.

Ciao.

Giuseppe