Search if an URL contains a user field

Sasquatchatmars — Wed, 14 Oct 2020 15:19:00 GMT

Hi all,

I made a search where I use a regular expression to extract the username from the email address because we noticed that a lot of phishing mails contain that pattern. The following line is the expression

| rex field=receiver_email "(?<user>[a-zA-Z]+.[a-zA-Z]+)\@"

Now I want to add the field "user" in a search query to very if in the content body of an email there is a URL with that field.
the search line that I tried is

| search content_body="<https://*user*>"

Of course this only verifies is the content equals to the string "user" but I don't know how to change it to the field value.

So just as an example if the URL is

A part of the content body https://someurl.com/idontknow/blabla<USER>blabla The rest of the content body

I should get a hit because the username is in that URL.

Thank you very much,

Sasquatchatmars

Re: Search if an URL contains a user field

richgalloway — Wed, 14 Oct 2020 17:03:55 GMT

Try using where rather than search, like this:

| makeresults | eval user="foo", content_body="<https://something.com/foo/otherstuff>" | where match(content_body,"<https://.*".user.".*>")

Re: Search if an URL contains a user field

Sasquatchatmars — Thu, 15 Oct 2020 08:06:50 GMT

Hi @richgalloway,

This was what I needed thank you!

Sasquatchatmars

topic Search if an URL contains a user field in Splunk Search

Search if an URL contains a user field

Re: Search if an URL contains a user field

Re: Search if an URL contains a user field