topic Re: SPL Code for rule: Potential Raspberry Robin Traffic is generating too much traffic. Help correct! in Splunk Search

SPL Code for rule: Potential Raspberry Robin Traffic is generating too much traffic. Help correct!

thrashec — Mon, 18 Mar 2024 11:01:18 GMT

| tstats allow_old_summaries=true summariesonly=t values(Web.dest_ip) as dest_ip, values(Web.http_referrer) as http_referrer, values(Web.http_user_agent) as http_user_agent, values(Web.url) as url, values(Web.user) as src_user from datamodel=Web where (Web.src=* OR Web.url=*) by _time Web.src, Web.url | `drop_dm_object_name("Web")` | rename Web.src as src_host | regex url= "^((?i)https?:\/\/)?\w{2,4}\.\w{2,6}:8080\/[a-zA-Z0-9]+\/.*?(?:-|\=|\?)" | append [search index=audit_digitalguardian sourcetype=digitalguardian:process Application_Full_Name=msiexec.exe Command_Line="*:8080*" src_host="raspberryrobin.local" | stats values(index) as index, values(sourcetype) as sourcetype, values(Command_Line) as cmdline, values(_raw) as payload by _time, src_host, url]

Re: SPL Code for rule: Potential Raspberry Robin Traffic is generating too much traffic. Help correct!

ITWhisperer — Mon, 18 Mar 2024 08:45:57 GMT

I am not clear what exactly you would like help with. Please expand on your issue, provide some anonymised representative sample events, give an idea of what your expected results are, an indication of what you are currently getting and why it is not what you were expecting.

Re: SPL Code for rule: Potential Raspberry Robin Traffic is generating too much traffic. Help correct!

thrashec — Tue, 19 Mar 2024 17:55:50 GMT

Expanded my search time results to 60 minutes as 24 hours or 30 days produced over a million events.
The 60 min search producing hundreds of thousands.

Can you review this rule to see if there is anything within the SPL code that is incorrect?
It should only product less than hundred . . . if even that.