topic Re: Identifying an asset over multiple sourcetype events in Getting Data In

Identifying an asset over multiple sourcetype events

shiftey — Tue, 26 May 2015 02:46:50 GMT

Hi Splunk Answers,
First post here, go easy on me!
We're running Splunk ES and I would like to create a correlation search. The criteria is:
If an IDS event is received for an internal IP (I could specify a range of required) (first sourcetype) and that same IP has recieved a malware alert within an hour of the IDS event (second sourcetype), then create a notable event.

Any clues as to what my syntax would be for this?

Cheers

Re: Identifying an asset over multiple sourcetype events

dineshraj9 — Tue, 26 May 2015 05:18:41 GMT

Either do a join or try map search -

Re: Identifying an asset over multiple sourcetype events

shiftey — Mon, 28 Sep 2020 20:03:13 GMT

Thanks for your response dineshraj9

In my case I dont have a "_time" field.
Time is broken down with the fields below, with example values
How can I eval time while considering the date also?

date_hour = 15
date_mday = 25
date_minute = 36
date_month = may
date_second = 28
date_wday = monday
date_year = 2015
date_zone = 0
timestartpos = 24
timeendpos = 0

Re: Identifying an asset over multiple sourcetype events

dineshraj9 — Tue, 26 May 2015 10:01:36 GMT

_time is an internal field and it won't show up on the left. _time would in epoch form. So at the end just process the time1 and time2 fields.

Re: Identifying an asset over multiple sourcetype events

shiftey — Tue, 26 May 2015 23:54:36 GMT

Thanks for that,

I am seeing results, what I am seeing is table headers:

time1 IP diff time2

time1 appears to show date and time for first sourcetype event and ip shows ip. time2 field is blank and diff shows a value which I think is in seconds? How would I show the associated event description with each sourcetype, just a case of adding to the table?

eg. sourcetype1=ids, sourcetype2=malware, how could I see the associated event description of each source type..

Hope that makes sense 🙂

Re: Identifying an asset over multiple sourcetype events

ppablo — Wed, 27 May 2015 00:42:54 GMT

Hi @shiftey and @dineshraj9

Please be sure that when responding to someone's answer, click on "Add comment" directly below their answer or, if responding to someone's comment, type in the "Add your comment..." box directly below their comment. You typed your responses to each other in the "Enter your answer here..." box at the very bottom of the page which, instead, posts a brand new answer when it was really meant as a comment. This will help with a clean continuous flow of the conversation. I already converted your "answers" to a comments appropriately, so just something to keep in mind from here on out. Thanks and happy Splunking!

Re: Identifying an asset over multiple sourcetype events

dineshraj9 — Mon, 28 Sep 2020 20:03:21 GMT

My Apologies.. there was typo in my previous post. It should be | convert ctime(time2) as time2(had given time1)

Use the _raw field to show the entire event. You can also give any other extracted fields from the events.