topic Re: search IOC in Splunk Enterprise Security

search IOC

theyukora — Sun, 07 Jun 2020 15:55:39 GMT

Hello,

i use lookup to find IOC in log.

in my lookup IOC.csv in FQDN column i have : lost.com and www.lost.com
my log is : "srcip=9.9.9.9 dstip=8.8.8.8 query=www.lost.com"
"index=test | lookup IOS.csv FQDN as query OUTPUT FQDN | search FQDN=* "

the problem is that only IOC www.lost.com will come out and not lost.com

I did find a solution with a request based on inputlookup but this is too greedy in resource

do you have a proposal for me? thank you

Re: search IOC

alonsocaio — Sat, 23 May 2020 15:02:51 GMT

Hi,

Maybe you could try to first extract the domain from your query field, and then search your IOC csv file.

index=answers 
| rex field=query "\.(?<domain>\w+\.\w+?)(?:$|\/)" 
| eval query = mvappend(query, domain) 
| lookup ioc FQDN as query OUTPUT FQDN 
| search FQDN=* 
| table srcip, dstip, query, FQDN

The search above had returned a table like this:

Also, if you are using Splunk Enterprise Security, I recommend you to take a look on the Threat Activity Detected correlation search and on the Splunk threat feeds feature.

Re: search IOC

theyukora — Sat, 23 May 2020 16:31:21 GMT

thank you i try

Re: search IOC

to4kawa — Sat, 23 May 2020 21:15:32 GMT

| rex field=query "\.(?<domain>\w+\.\w+?)(?:$|\/)" can't handle about www.bbc.co.uk ,www.cctv.com.cn

| rex field=query "[\w-]+\.(?<domain>[^\/:]+)" is better.

Re: search IOC

theyukora — Sun, 24 May 2020 09:54:43 GMT

thank you very much for this introduction to the notion of rexgex which I did not know in SPLUNK.

now I complicate it a bit:

in my IOC.csv in FQDN column i have:

873.lost.com
lost.com
always.lost.com
31.always.lost.com

and i have two logs:

"srcip=9.9.9.9 dstip=8.8.8.8 query=www.123654873.lost.com"
"srcip=9.9.9.9 dstip=8.8.8.8 query=87431.always.lost.com"

the one solution would be to be able to put a "*" in front of the FQND when it is compared.
If I put "*" in front of each FNDN in my IOC.csv it is considered as a character.

sorry for the headaches 😉

Re: search IOC

alonsocaio — Sun, 24 May 2020 18:23:11 GMT

Well, since you need to match the FQDN, I guess that using the regex proposed by @to4kawa would help you better.

But just to confirm, you need "87431.always.lost.com" to match just "always.lost.com" on your IOC list? Or do you need it to also match "lost.com"?

Re: search IOC

theyukora — Mon, 25 May 2020 07:06:56 GMT

the hoped result is that for the LOG:

"srcip=9.9.9.9 dstip=8.8.8.8 query=www.123654873.lost.com"

I must have iOC : lost.com , 873.lost.com

ans for the log:

"srcip=9.9.9.9 dstip=8.8.8.8 query=87431.always.lost.com"

I must have IOC : lost.com, always.lost.com, 31.always.lost.com