Scenario: I am trying to check my DNS logs for queries to malicious domains on the getwatchlist [http://mirror1.malwaredomains.com/files/domains.txt].
So far I have reformatted my DNS queries (e.g. from: (14)registerdisney(2)go(3)com(0) to: registerdisney.go.com) with the following code
index=DNSlogs | eval reformattedDomain = replace(replace(questionname,"\(\d+\)","."),"\.(.*)\.","\1") | stats list(*)
Now I need to correlate my [reformattedDomain] to the [domain] field in malware_domainsdm.csv and the following code works:
|getwatchlist malwaredomains | outputlookup malware_domainsdm.csv
I get these fields [ domain, category, reference, date] however I am not finding the right syntax to make the connection.
Please provide any examples.
Thank you!
You can try adding something like this to the end of your search:
| lookup malware_domainsdm.csv domain AS reformattedDomain | search category=*
which would perform the lookup against the downloaded list, using the reformattedDomain
as the key against the values in the domain
field. Then the search
command filters the results to only show the items for which the lookup was successful. You may not want the stats
portion of the search you have in your search.
HTH,
Dave
You can try adding something like this to the end of your search:
| lookup malware_domainsdm.csv domain AS reformattedDomain | search category=*
which would perform the lookup against the downloaded list, using the reformattedDomain
as the key against the values in the domain
field. Then the search
command filters the results to only show the items for which the lookup was successful. You may not want the stats
portion of the search you have in your search.
HTH,
Dave
index=msad | eval reformattedDomain = replace(replace(questionname,"\(\d+\)","."),"\.(.*)\.","\1")
|stats count by reformattedDomain
|lookup malware_domainsdm.csv domain AS reformattedDomain
| eval domainmatch=if(reformatedDomain==domain, "bad", "good")
This gets me closer but I am having trouble populating the other malwaredomaindm.csv fields like category, date, and reference. Any ideas?
Thank you
Thanks Dave, before I accept, do you know how to write an [eval domainmatch = if (reformattedDomain = domain) then add a value of good or bad in a new domain field?
Thanks
I think you want something like:
| eval domainmatch=if(reformatedDomain==domain, "bad", "good")
You could also try:
| eval if(isnull(category), "good", "bad")