All Apps and Add-ons

Multiple EVALS in Props for Threat Intel Lookup


I am trying to compare threat intelligence data against our web filtering logs. The IOC's come over with http:// or https:// included for each url. Unfortunately my proxy logs do not have this included in the url field and it is not included in the event anywhere at all to concatenate strings. So at search time I am looking at the destination port of each request and determining whether or not it is http or https.

| eval destinationProtocol=case(dest_port ==443, "https", dest_port ==80, "http") | eval url=destinationProtocol. "://" .url

This works as expected when using it in an inline search. However my threat intelligence app is using a data model when running the search to look for matching IOC's and I can't do an EVAL in the data model constraints. So I tried throwing these EVAL's in the props.conf on the search head. Obviously the 2nd EVAL is dependent on the 1st one completing first, so that doesn't work. My understanding is they run in parallel so that will never work.

The other option I tried was to add | eval destinationProtocol=case(dest_port ==443, "https", dest_port ==80, "http") to the TA on the index cluster and add the other eval at search time; but that doesn't seem to work either.

I am at a loss, am I going about this wrong? Any ideas? If anybody has any suggestions I would appreciate it.

End result just needs to be "http://url" in the url field

0 Karma


Here is the line I added to the props on the index cluster

EVAL-destination_protocol=case(dst_port == 443, "https", dst_port == 80, "http")

The destination field never makes it to the event.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...