topic inbound OR outbound communication pattern matched in Getting Data In

inbound OR outbound communication pattern matched

riqbal47010 — Tue, 05 Nov 2019 12:43:27 GMT

I copied the bad reputed IP address, Hashes and Domains from any.run/malware-trends/remote
now how can I find the results that matches bad reputed IP against any source or destination.

Re: inbound OR outbound communication pattern matched

gcusello — Wed, 30 Sep 2020 02:52:36 GMT

Hi riqbal47010,
could you describe more your request?
I think that you're speaking about proxy logs, how do you ingested them?
Can you share an example of your proxy logs?

Anyway, if you have proxy logs in an index called proxy_index and you already extracted a field called ip_dest, you could insert the information you copied by any.run in a lookup called e.g. anyrun.csv that contain three fields (ip, hash, domain).
Then you can run something similat to this:

index=proxy_index ip_dest=* [ | inputlookup anyrun.csv | rename ip AS ip_dest | fields ip_dest ]
| ...

Ciao.
Giuseppe

Re: inbound OR outbound communication pattern matched

riqbal47010 — Wed, 06 Nov 2019 05:37:52 GMT

Hi gcusello,

the concept mostly based on "threat activity detected" rule. that any value matched either source or destination he should trigger. your query( i believe) is just one sided.

Re: inbound OR outbound communication pattern matched

gcusello — Wed, 06 Nov 2019 07:36:56 GMT

Hi riqbal47010,
If you have to check two fields, you can use the same approach:

index=proxy_index ip_dest=* ([ | inputlookup anyrun.csv | rename ip AS ip_dest | fields ip_dest ] OR [ | inputlookup anyrun.csv | rename ip AS ip_source | fields ip_source ])
| ...

Ciao.
Giuseppe