All Apps and Add-ons

Can the Splunk App for Stream log the ciphers negotiated during a TLS handshake to detect when a LogJam attack has occurred?

cygnetix
Path Finder

Anyone know if Splunk Stream can log the ciphers negotiated during a TLS handshake? I'm thinking about using it to detect when a LogJam (CVE-2015-4000) attack has occurred.

I can't see anything relevant listed for SSL/ TLS in the doco, but I figure it doesn't hurt to ask: http://docs.splunk.com/Documentation/StreamApp/6.2.2/DeployStreamApp/Whattypeofdatadoesthisappcollec...

0 Karma
1 Solution

mdickey_splunk
Splunk Employee
Splunk Employee

It looks like our docs are missing several of the SSL fields available in TCP flow events. Give this query a try:

sourcetype=stream:tcp ssl_signature_algorithm=* | stats count by ssl_signature_algorithm

View solution in original post

mdickey_splunk
Splunk Employee
Splunk Employee

It looks like our docs are missing several of the SSL fields available in TCP flow events. Give this query a try:

sourcetype=stream:tcp ssl_signature_algorithm=* | stats count by ssl_signature_algorithm

vlado
Engager

This search works but I have a large number of hits where ssl_signature_algorithm is not populated ie. is empty.

Any idea why?

0 Karma

mdickey_splunk
Splunk Employee
Splunk Employee

I believe it is only populated when there is a new SSL session/handshake. So, it will be empty for subsequent TCP flows that re-use previously negotiated session keys.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...