topic Re: Modifying searches to exclude IP address in Dashboards & Visualizations

Modifying searches to exclude IP address

Ted1621 — Sun, 09 Oct 2022 22:21:42 GMT

How would I modify this search :

| tstats prestats=true summariesonly=true allow_old_summaries=true count from datamodel=Authentication.Authentication where Authentication.app=win* Authentication.action=$action$ by _time, Authentication.user span=10m
| timechart minspan=10m useother=true count by Authentication.user limit=50

to exclude this IP Address: src_ip!="10.0.1.90"

Re: Modifying searches to exclude IP address

bowesmana — Sun, 09 Oct 2022 22:48:02 GMT

I believe src is the field in the datamodel that contains the ip - so just add the constraint to the existing where clause

| tstats prestats=true summariesonly=true allow_old_summaries=true count from datamodel=Authentication.Authentication where Authentication.app=win* Authentication.action=$action$ Authentication.src!="10.0.1.90" by _time, Authentication.user span=10m | timechart minspan=10m useother=true count by Authentication.user limit=50

Re: Modifying searches to exclude IP address

Ted1621 — Mon, 10 Oct 2022 03:00:48 GMT

This did not seem to work I still see the failed logins from this source...

| tstats prestats=true summariesonly=true allow_old_summaries=true count from datamodel=Authentication.Authentication where Authentication.app=win* Authentication.action=$action$ Authentication.src_ip!="10.0.1.90" by _time, Authentication.user span=10m
| timechart minspan=10m useother=true count by Authentication.user limit=50

Re: Modifying searches to exclude IP address

bowesmana — Mon, 10 Oct 2022 03:44:55 GMT

How can you see that there are failed logins from this source? You tstats will only give you count, _time and user.

If you also split by the IP and don't do the timechart, can you see 10.0.1.90 as a src/src_ip?

Does your Authentication DM contains src_ip as opposed to just src?