Alerting

Correlation in Splunk Enterprise

kenneth_wong
New Member

Hi Guys,

I am new to Splunk Enterprise. I am currently setting up a testlab to do correlation event for a simulation attack (from Kali Linux) on an Apache Web Server (with ModSecurity installed). As I am trying to correlation two source types: one from Firewall and one from ModSecurity so that upon an attack attempt from Kali Linux(Attacker) will auto trigger an alert. I would like to understand whether it is possible to achieve this correlation event alert without Splunk Enteprise Security.

Your help is very much appreciated.

Thanks.

Regards,
Kenneth

Tags (1)
0 Karma
1 Solution

jpolcari
Communicator

This is definitely possible without ES. There are a few options for correlating data within Splunk:

-Using the transactioncommand: http://docs.splunk.com/Documentation/Splunk/6.4.3/SearchReference/Transaction
-Using a sub search: http://docs.splunk.com/Documentation/Splunk/6.4.2/SearchTutorial/Useasubsearch
-Using a lookup: http://docs.splunk.com/Documentation/Splunk/6.4.2/SearchReference/Lookup

Depending on what exactly you are trying to correlate (IPs, etc), you should be able to use one of those methods to correlate between the firewall and ModSecurity.

View solution in original post

0 Karma

kenneth_wong
New Member

Hi jpolcari

Thanks for your enlightenment. I managed to address my concern with join command where I can correlate the events from both two different data sources with same fieldname of source IP and destination port.

My search command is as follows that I would like to share:

sourcetype="sophos:utm:firewall" srcip=* dstport=80 | join srcip dstport [search sourcetype="modsec_audit"|rename SRC as srcip DPT as dstport]

Thanks.

Regards,
Kenneth

0 Karma

jpolcari
Communicator

This is definitely possible without ES. There are a few options for correlating data within Splunk:

-Using the transactioncommand: http://docs.splunk.com/Documentation/Splunk/6.4.3/SearchReference/Transaction
-Using a sub search: http://docs.splunk.com/Documentation/Splunk/6.4.2/SearchTutorial/Useasubsearch
-Using a lookup: http://docs.splunk.com/Documentation/Splunk/6.4.2/SearchReference/Lookup

Depending on what exactly you are trying to correlate (IPs, etc), you should be able to use one of those methods to correlate between the firewall and ModSecurity.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...