https://community.splunk.com/t5/Splunk-Enterprise-Security/SQL-Injection-Rule-Multivalue-count-with-multiple-statistical/m-p/482324#M7787 <P>your welcome, Happy Splunking.</P> Wed, 13 Nov 2019 12:44:32 GMT to4kawa 2019-11-13T12:44:32Z https://community.splunk.com/t5/Splunk-Enterprise-Security/SQL-Injection-Rule-Multivalue-count-with-multiple-statistical/m-p/482321#M7784 <P>Hi,</P> <P>I'm trying to add an additional condition to this rule.</P> <P>Currently it splits up the raw value from our web logs trying to find SQL injection, although I want to lower the number of commands it needs to alert, but add a count to where the src ip is greater than 5. And I can't seem to make it work. </P> <P>The command below is what I currently have already:</P> <PRE><CODE>index=foo NOT src="10.0.0.0/8" NOT src="172.16.0.0/12" NOT src="192.168.0.0/16" | eval num_sql_cmds=mvcount(split(_raw, "alter%20table")) + mvcount(split(_raw, "between")) + mvcount(split(_raw, "create%20table")) + mvcount(split(_raw, "create%20database")) + mvcount(split(_raw, "create%20index")) + mvcount(split(_raw, "create%20view")) + mvcount(split(_raw, "delete")) + mvcount(split(_raw, "drop%20database")) + mvcount(split(_raw, "drop%20index")) + mvcount(split(_raw, "drop%20table")) + mvcount(split(_raw, "exists")) + mvcount(split(_raw, "exec")) + mvcount(split(_raw, "group%20by")) + mvcount(split(_raw, "having")) + mvcount(split(_raw, "insert%20into")) + mvcount(split(_raw, "inner%20join")) + mvcount(split(_raw, "left%20join")) + mvcount(split(_raw, "right%20join")) + mvcount(split(_raw, "full%20join")) + mvcount(split(_raw, "select")) + mvcount(split(_raw, "distinct")) + mvcount(split(_raw, "select%20top")) + mvcount(split(_raw, "union")) + mvcount(split(_raw, "xp_cmdshell")) + mvcount(split(_raw, "1=1")) -25 | where num_sql_cmds &gt;= 2 </CODE></PRE> <P>This is to eliminate if we see a single IP which hits on legitimate traffic. For example, the following uri will match the conditions but only had event in the logs, where an actual SQL injection would likely hit a number of times from the same IP. </P> <PRE><CODE> /Secure/Int/OnlineService/ReviewService/scripts/core/components/select-option/select-option.htm </CODE></PRE> <P>Any help would be appreciated.</P> <P>Thanks</P> Tue, 12 Nov 2019 12:08:43 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/SQL-Injection-Rule-Multivalue-count-with-multiple-statistical/m-p/482321#M7784 swright_rl 2019-11-12T12:08:43Z https://community.splunk.com/t5/Splunk-Enterprise-Security/SQL-Injection-Rule-Multivalue-count-with-multiple-statistical/m-p/482322#M7785 <PRE><CODE>index=foo src!="10.0.0.0/8" src!="172.16.0.0/12" src!="192.168.0.0/16" | stats count(eval(searchmatch("alter%20table") OR searchmatch("between") OR ....))) as num_sql_cmds by src | where num_sql_cmds &gt;= 2 </CODE></PRE> <P>Hi, how about it?</P> Tue, 12 Nov 2019 12:41:34 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/SQL-Injection-Rule-Multivalue-count-with-multiple-statistical/m-p/482322#M7785 to4kawa 2019-11-12T12:41:34Z https://community.splunk.com/t5/Splunk-Enterprise-Security/SQL-Injection-Rule-Multivalue-count-with-multiple-statistical/m-p/482323#M7786 <P>That works great thank you! <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Tue, 12 Nov 2019 14:43:38 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/SQL-Injection-Rule-Multivalue-count-with-multiple-statistical/m-p/482323#M7786 swright_rl 2019-11-12T14:43:38Z https://community.splunk.com/t5/Splunk-Enterprise-Security/SQL-Injection-Rule-Multivalue-count-with-multiple-statistical/m-p/482324#M7787 <P>your welcome, Happy Splunking.</P> Wed, 13 Nov 2019 12:44:32 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/SQL-Injection-Rule-Multivalue-count-with-multiple-statistical/m-p/482324#M7787 to4kawa 2019-11-13T12:44:32Z