topic Re: Query Correlation in Splunk Search

Query Correlation

cesaralzaga — Mon, 28 Sep 2020 13:58:31 GMT

I was hoping that someone could help me out with a query. I am trying to correlate a DNS request to the firewall IP that was being forward. The firewall shows only the IP related to a rule that fired and I am trying to create a query that will capture the domain name query (DNS) that was associated with the rule(FIREWALL).

I have sourcetype=named query from IP: 72.9.231.10 Port:3391 Name: Paimia.com Destination: 141.101.116.157
sourectype=snort_alerts Blackhole_toolkit 141.101.116.157

I want to build a guery which will show all events from the souretype=snort Blackhole_tookit rule and destination IPs in common with destination IPs in the sourcetype=named.

Re: Query Correlation

kristian_kolb — Fri, 24 May 2013 18:47:45 GMT

without posting any sample events, it's going to be hard for anybody to help you.

Re: Query Correlation

kml_uvce — Mon, 28 Sep 2020 13:58:39 GMT

with your less information ,i built below query... here its give output from both sourcetypes and common ip.

sourcetype=snort_alerts "Blackhole_toolkit" |join ip [search sourcetype=named]

Re: Query Correlation

cesaralzaga — Thu, 30 May 2013 04:09:38 GMT

Thanks for Your help. It was spot on.

Re: Query Correlation

kml_uvce — Thu, 30 May 2013 04:15:08 GMT

Please vote or accept this as ans