topic Re: Scripting, Search, Passing Vars in All Apps and Add-ons

Scripting, Search, Passing Vars

username9000 — Thu, 27 Dec 2012 22:18:55 GMT

Greetings,

I am trying to setup up Splunk to count the failed login attempts on our firewall and then run a script that will login to the firewall and block said IP address.

Currently, I have it setup to capture failed login attempts and run the default script (echo.sh) for testing purposes.

My questions is, how do I count and pass the IP address after “from” in the log below?

Dec 27 15:37:36 192.168.4.1 seclogin: [2012 Dec 27 15:37:36] UTM5 Login failed: invalid user sdhsdh from 192.168.4.3

Do I have to create a field type or use the field extractor? How does either, affect Splunks outputs listed here: http://docs.splunk.com/Documentation/Splunk/5.0.1/Alert/Configuringscriptedalerts

Re: Scripting, Search, Passing Vars

BobM — Thu, 27 Dec 2012 22:30:44 GMT

Assuming you already have the src_ip field being extracted, you need a stats command to build a count. Try the following search over a relevant time period:-

seclogin: "Login failed" "invalid user" | stats count by src_ip | where count>20

Re: Scripting, Search, Passing Vars

username9000 — Fri, 28 Dec 2012 14:32:58 GMT

Hi Bob,

No I have not extracted the src_ip field. Am I to define a regular expression to extract the IP or is there a more friendly GUI approach?

Re: Scripting, Search, Passing Vars

BobM — Fri, 28 Dec 2012 14:58:35 GMT

The interactive field extractor can do this for you.
There is a quick 3min video here http://www.splunk.com/view/SP-CAAADUY
and the docs are here http://docs.splunk.com/Documentation/Splunk/5.0.1/Knowledge/ExtractfieldsinteractivelywithIFX

Re: Scripting, Search, Passing Vars

username9000 — Fri, 28 Dec 2012 16:00:14 GMT

The logs only have one IP address in them (192.168.4.3), by using the GUI will it account for IP addresses that vary in the individual octet? For example, 17.45.252.1? etc? Or do i need to edit the rex syntax? I receive an error message for entering IP addresses that are not found within the log.

Re: Scripting, Search, Passing Vars

BobM — Fri, 28 Dec 2012 16:10:43 GMT

The regex should be generic and accept any numbers.

Re: Scripting, Search, Passing Vars

username9000 — Fri, 28 Dec 2012 16:20:50 GMT

I found this in another thread, seems to have done the trick.

\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})"

thx for ur help