alert based on data on previous and new event

Path Finder

Apr 25 17:13:28 www2 sshd[27718]: [ID 800047 auth.debug] debug1: no match: WinSCP_release_4.3.2

[..within 5 secs..]

Apr 25 17:13:29 www2 sshd[27718]: [ID 800047] Failed none for john from port 1358 ssh2

So if winscp is below 4.0.4 get an alert saying john is using older release. Because that is
sshd2 process 27718 belongs to john.

How do I correlate between two events, 5+ secs apart, based on the process id and then generate an appropriate alert if a the number portion of the string is below 4.0.4?

Alert will always go to

Tags (1)
0 Karma

Path Finder

looks like this gave me what I wanted..

source="sshd.log" | rex field=raw "sshd[(?\d+)]: " | transaction pid maxspan=60s | search winscp | rex field=_raw "version WinSCP_release(?\d).(?\d).(?\d)" | eval version=major_version.minor_version1.minor_version2 | where version < 423

any suggestion on how to improve it appreciated

0 Karma

Path Finder

ok so I "improved" the search

source="sshd.log" | rex field=raw "sshd[(?\d+)]: " | transaction pid maxspan=60s | search winscp or accepted | rex field=_raw "version WinSCP_release(?\d).(?\d).(?\d)" | eval version=majv.minv1.minv2 | where version < 423 | rex "for (?[^ ]+) from" | eval ver=majv.".".minv1.".".minv2 | eval date=date_month."/".date_mday."/".date_year| table user ver date

looking for a suggestion to improve this search.

0 Karma

Path Finder

So this is where I am now

I like to generate a table output instead

user winscp_release

pgaul 4.1.8 or even WinSCP_release_4.1.8

0 Karma

Path Finder

with the help of Ayn from #splunk I got this far

source="sshd.log" | rex field=_raw "sshd[(?\d+)]: " | transaction pid

So that is a good start

Also, a separate search like this works, which displays the events where winscp version
is lower than 4.0.4

source="sshd.log" | rex field=raw
"version WinSCP_release
(?\d)" |
eval version=major_version.minor_version1.minor_version2 | where version < 419

Now if both events has the same pid then display the event that happens in next 60s
with same pid and has the username displayed like below

Here is an exerpt of the log

Here is the result should look like

Apr 20 16:17:11 www2 sshd[10895]: [ID 800047 auth.debug] debug1: userauth-request for user pgaul service ssh-connection method none

because user pgaul using an winscp whose version is higher than 4.2.0

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...