topic Re: splunk dashboard searching in Dashboards & Visualizations

splunk dashboard searching

sam3655 — Fri, 12 May 2017 11:21:12 GMT

on the splunk dashboard, is there a way to search for origin/source of a malware attack?

Re: splunk dashboard searching

lloydknight — Fri, 12 May 2017 11:36:40 GMT

your question is vague.

Assuming you're indexing logs containing the Malware attack and given that you know what type of attacks were executed on a certain time, yes, you can search that malware attack.

Re: splunk dashboard searching

sam3655 — Fri, 12 May 2017 12:35:35 GMT

is there a script for the search?

Re: splunk dashboard searching

akocak — Fri, 12 May 2017 13:10:22 GMT

are you looking at table or raw event data?
Moreover, origin in the sense of ip look lookup? Can you share more about what do you see?

thanks

Re: splunk dashboard searching

DalJeanis — Fri, 12 May 2017 13:45:56 GMT

Yes. NO. Maybe. It depends.

It depends on what you mean by "dashboard". It depends on what kind of attack. It depends on what your organization actually puts in splunk.

So, please update your question to be VERY specific.

We experienced an ABC attack, which
had THIS effect on our
organization/network/data.

What log data would we need to have
captured in order to determine the
source of the attack? What resources
are available in the splunk platform
to help us track that down?

Re: splunk dashboard searching

sam3655 — Fri, 12 May 2017 14:14:57 GMT

FireEye monitors our network and catches Malware Callbacks, I'm looking for a script tell me who sent the Malware?

Re: splunk dashboard searching

lloydknight — Tue, 16 May 2017 06:15:49 GMT

Not very familiar with FireEye logs but logs can be pretty straightforward at most times. If source and destination IPs are visible in the logs, and you know what specific Malware attack to look up to then it's just a matter of identifying what time it occurred.

And if the source is not available in the logs, you'll just have to index the logs that contain the source (most likely firewall and network logs) then try to correlate it with the logs that contain the Malware attack.

Regarding the script that you're asking, you mean search query?