topic Re: Query Question in Dashboards & Visualizations

Query Question

colraj — Mon, 17 Aug 2020 05:25:15 GMT

Hello Team,

Can someone help me with creating a query to report if there are multiple blocked requests from a single IP? Please find the sample alert below.

Please email me @colwinrebeiro.rajendran@hidglobal.com.

action	httpSourceId	webaclId	httpRequest.uri	httpRequest.clientIp	ruleGroupList{}.terminatingRule.ruleId	terminatingRuleType	terminatingRuleId
BLOCK	555662058394-app/ALB-EXT-ORIGO-API-CERT/611b0867bb7ac42c	arn:aws:wafv2:us-east-1:555662058394:regional/webacl/WEBACL-ALB-EXT-ORIGO-API-CERT/b83fd96e-c7ae-4c20-93cb-4a2b1404e57e	/	185.185.41.193		REGULAR	Default_Action

Regards

Colwin

Re: Query Question

gcusello — Mon, 17 Aug 2020 07:44:06 GMT

Hic @colraj,

you have to extract the fields you need (action and httpRequest_clientIp) and use the stats count command, something like this:

| makeresults | eval _raw="2020-08-17 10:22:56 BLOCK 555662058394-app/ALB-EXT-ORIGO-API-CERT/611b0867bb7ac42c arn:aws:wafv2:us-east-1:555662058394:regional/webacl/WEBACL-ALB-EXT-ORIGO-API-CERT/b83fd96e-c7ae-4c20-93cb-4a2b1404e57e / 185.185.41.193 REGULAR Default_Action" | rex "\d+-\d+-\d+\s+\d+:\d+:\d+\s(?<action>\w+).*\s+(?<httpRequest_clientIp>\d+\.\d+\.\d+\.\d+)\s" | search action="BLOCK" | stats count BY httpRequest_clientIp | where count > 0

In your real situation, you have to modify the regex because I don't know if the time stamp at the beginning of the event really has this format in your events (it wasn't in the example and I supposed "2020-08-17 10:22:56".

Anyway, the approach is:

run your main search,
extract the fields "action" and "httpRequest_clientIp" using regexes,
filter for action="BLOCK",
count the occurrencies for each httpRequest_clientIp,
put a threeshold (0 in this example) to take only counts greater than the threeshold.

if you share an example of your logs I could be more precise in the regex.

Ciao.

Giuseppe

Re: Query Question

colraj — Mon, 17 Aug 2020 08:45:44 GMT

Hello Sir,

Thanks for the response. But since I am new to to splunk. I am not sure what information(logs) do you actually need. If you are fine, we can do a screen sharing session so that you can understand or please let me know where i can find this log information for this particular task.

Re: Query Question

gcusello — Tue, 18 Aug 2020 07:49:18 GMT

Hi @colraj,

remember that in a Splunk job 70% is the knowledge of the technology you're working, 30% is how to use this knowledge in Splunk.

This means that the problem isn't in your Splunk knowledge: you have to know very well the logs you're analyzing: knowing the fields, the error messages, etc...

When you have a clear idea of what there's in your logs and what you need to extract and find, then you can approach Splunk to build and run the search.

So, start from the logs you have, then analyze them finding the useful informations, then identify what are the conditions to find.

Without these informations it isn't possible to create and run a Splunk search.

Ciao.

Giuseppe