topic Re: How to prepend a value to a field at search-time to sanitize malicious URLs? in Splunk Search

How to prepend a value to a field at search-time to sanitize malicious URLs?

JSkier — Wed, 22 Jun 2016 20:25:13 GMT

I'd like to sanitize host names during search time in Splunk (IDS alerts), so users don't receive a hyperlink to the bad sites and the alerts don't get snagged by the mail filter. I'd like to keep the inline table results of the alerts for mobile users and general convenience.

For example, www.badsite.com is automatically hyperlinked in e-mail clients, so I'd like to prepend hxxp:// to the field so the sent alert message doesn't get hyperlink or dropped. By specifying a bogus protocol both fat mail client and mail scanner will pass the inline table without issue.

I found something about appending in the community, but that just shows a blank field during search for me (even when I assign httphostname without a period).

eval http.hostname=http.hostname."hxxp://" |

In theory, I'd like this to prepend and actually work:

eval http.hostname="hxxp://".http.hostname |

I'm using Splunk 6.3.2 in a clustered Linux environment, any help is appreciated.

Re: How to prepend a value to a field at search-time to sanitize malicious URLs?

sundareshr — Wed, 22 Jun 2016 20:37:54 GMT

Try putting your field name with single quotes. Like this

| eval http.hostname="hxxp://".`http.hostname`

Re: How to prepend a value to a field at search-time to sanitize malicious URLs?

woodcock — Wed, 22 Jun 2016 20:38:46 GMT

Assuming that you have a field called http.hostname then like this:

... | eval "http.hostname" = "hxxp://" . $http.hostname$

Or possibly this:

... | rex field="http.hostname" mode=sed "s/^http:/hxxp:/"

Re: How to prepend a value to a field at search-time to sanitize malicious URLs?

JSkier — Wed, 22 Jun 2016 20:41:25 GMT

Error in 'SearchParser': The name 'http.hostname' is invalid. Macro and argument names may only include alphanumerics, '_' and '-'.

Re: How to prepend a value to a field at search-time to sanitize malicious URLs?

JSkier — Wed, 22 Jun 2016 20:43:34 GMT

This worked perfectly, thanks!
... | eval "http.hostname" = "hxxp://" . $http.hostname$