Splunk query to find IP attack in Geo Map

alexspunkshell — Fri, 19 Feb 2021 18:12:25 GMT

index=graphsecurityalert having information's about all attacks in "title" field

index=zscaler having information's about all IP & location but it don't have logs about attacks.

Now i want query to find in geo map with IP and title of the attack.

i tried index=graphsecutity OR index=zscaler title=* | iplocation src_ip | geostats count by userStates{}.logonLocation but i am unable to get results.

Please help me with query to find IP attacks in geo map

@soutamo @saravanan90 @thambisetty @ITWhisperer @gcusello @bowesmana @to4kawa

Re: Splunk query to find IP attack in Geo Map

tscroggins — Sat, 20 Feb 2021 19:03:23 GMT

@alexspunkshell

Can you provide sanitized sample events? I'm assuming you want to join Microsoft Graph Security API Add-On for Splunk events with Zscaler Technical Add-On for Splunk events.

topic Splunk query to find IP attack in Geo Map in Splunk Search

Splunk query to find IP attack in Geo Map

Re: Splunk query to find IP attack in Geo Map