topic Match all possible matches to lookuplist in Splunk Search

Match all possible matches to lookuplist

rtalcik — Wed, 30 Sep 2020 04:44:16 GMT

so inside the lookup list i want to be able to match for example a threat of -- reason.com OR www.reason.com

i added the matchtype option of WILDCARD(emotet_domain) AND I have also tried WILDCARD(domain) I am not sure whihc one will help wildcard it, but as of right now it is NOT working.

Re: Match all possible matches to lookuplist

to4kawa — Sat, 28 Mar 2020 01:30:39 GMT

index=proxy domain=* [| inputlookup test | stats values(emotet_domain) as query |format]
| lookup test emotet_domain as domain OUTPUT emotet_domain

Re: Match all possible matches to lookuplist

woodcock — Sun, 29 Mar 2020 22:39:08 GMT

Assuming that your lookup has domain values like reason.com, all you need to do is this and then it should work:

inputlookup test
| eval emotet_domain = "*." . emotet_domain
| outputlookup test

Then use it like this:

index=proxy domain=*
| lookup test emotet_domain AS domain OUTPUT emotet_domain AS MATCHED
| where isnotnull(MATCHED)

Re: Match all possible matches to lookuplist

rtalcik — Mon, 30 Mar 2020 00:08:56 GMT

Thanks this would def help in the future, unfortunately what was below will help even better.

Re: Match all possible matches to lookuplist

rtalcik — Wed, 30 Sep 2020 04:49:37 GMT

So, what this is doing is it is searching all the events that happened and that it matches. I need to match the latest event so it only triggers an alert.

I also need to add more to it as well such as

index=proxy domain=* OR index=network* src_ip=* dest_ip=*
[| inputlookup test
| stats values(emotet_domain) as query, values(emotet_ip) as IP
|format]
| lookup test emotet_domain as domain OUTPUT emotet_domain
| lookup test emotet_ip as dest_ip OUTPUT emotet_ip
| lookup test emotet_ip as src_ip OUTPUT emotet_ip

will this work??

Re: Match all possible matches to lookuplist

to4kawa — Mon, 30 Mar 2020 09:24:55 GMT

I see what you want.
Let's ask another question.
at the time, please provide Csv sample and setting.