https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-malware-search-to-find-users-with-packets-sent/m-p/269762#M81184 <P>Yes, but it only gives users with activity in each bucket. </P> <P>Let's say we have three buckets:<BR /> bucket1:<BR /> user1,user2,user3<BR /> bucket2:<BR /> user1,user4,user5<BR /> bucket3:<BR /> user1,user4,user6</P> <P>So, I want to display only the usernames with activity in all buckets, so in this case it's only user1.</P> Mon, 30 Jan 2017 20:25:56 GMT edvornit 2017-01-30T20:25:56Z https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-malware-search-to-find-users-with-packets-sent/m-p/269758#M81180 <P>I'd like to find users with activity in every 1/3/5 minute bucket in the last 24 hours as the indication of possible malware/botnet beaconing.</P> <P>Let's say I have sourcetype=firewall and bytes_out/packets_out for activity and src_user for user.</P> <P>Any idea how to write such search?</P> Tue, 29 Sep 2020 12:40:10 GMT https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-malware-search-to-find-users-with-packets-sent/m-p/269758#M81180 edvornit 2020-09-29T12:40:10Z https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-malware-search-to-find-users-with-packets-sent/m-p/269759#M81181 <P>Something like this. You can update the span per your need.</P> <PRE><CODE>index=YourINdex sourcetype=firewall | bucket span=1m _time | stats sum(bytes_out) as bytes_out sum(packets_out) as packets_out by _time activity src_user </CODE></PRE> Mon, 30 Jan 2017 19:56:12 GMT https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-malware-search-to-find-users-with-packets-sent/m-p/269759#M81181 somesoni2 2017-01-30T19:56:12Z https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-malware-search-to-find-users-with-packets-sent/m-p/269760#M81182 <P>How would you filter it further to get only the users that have packets_out &gt; 10 in every 5 min bucket?</P> Mon, 30 Jan 2017 20:07:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-malware-search-to-find-users-with-packets-sent/m-p/269760#M81182 edvornit 2017-01-30T20:07:07Z https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-malware-search-to-find-users-with-packets-sent/m-p/269761#M81183 <P>With current query, it's giving you total packets sent by activity-src_user combination for every minute. For get "only the users that have packets_out &gt; 10 in every 5 min bucket", first change the span to 5m and use where clause to filter it.</P> <PRE><CODE>index=YourINdex sourcetype=firewall | bucket span=5m _time | stats sum(bytes_out) as bytes_out sum(packets_out) as packets_out by _time activity src_user | where packets_out&gt;10 </CODE></PRE> Tue, 29 Sep 2020 12:40:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-malware-search-to-find-users-with-packets-sent/m-p/269761#M81183 somesoni2 2020-09-29T12:40:14Z https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-malware-search-to-find-users-with-packets-sent/m-p/269762#M81184 <P>Yes, but it only gives users with activity in each bucket. </P> <P>Let's say we have three buckets:<BR /> bucket1:<BR /> user1,user2,user3<BR /> bucket2:<BR /> user1,user4,user5<BR /> bucket3:<BR /> user1,user4,user6</P> <P>So, I want to display only the usernames with activity in all buckets, so in this case it's only user1.</P> Mon, 30 Jan 2017 20:25:56 GMT https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-malware-search-to-find-users-with-packets-sent/m-p/269762#M81184 edvornit 2017-01-30T20:25:56Z