Archive

How to search for several events with one unique identifier field?

Path Finder

Hi all,
I'm trying to find a query that returns all the following tag_name with the same "source" field:
misp-galaxy:continents="Asia"
misp-galaxy:targeted-region="Russia"
misp-galaxy:ransomware="Troldesh orShade, XTBL"

The tricky part is that I have to run the search on all my source files, where the source file is actually the single-valued identifier.
What I tried was something like this:

(index=misp-events source="/var/scripts/events/*" misp-galaxy:continents="Asia") AND (index=misp-events source="/var/scripts/events/*" misp-galaxy:targeted-region="Russia") AND (index=misp-events source="/var/scripts/events/*" misp-galaxy:ransomware="Troldesh orShade, XTBL")

alt text

0 Karma
1 Solution

Path Finder

Not sure if I understood you correctly but try this:

 (index=misp-events source="/var/scripts/events/*") (misp-galaxy:continents="Asia" OR misp-galaxy:targeted-region="Russia" OR misp-galaxy:ransomware="Troldesh orShade, XTBL")

Lett me know if this doesnt help

View solution in original post

0 Karma

Path Finder

Not sure if I understood you correctly but try this:

 (index=misp-events source="/var/scripts/events/*") (misp-galaxy:continents="Asia" OR misp-galaxy:targeted-region="Russia" OR misp-galaxy:ransomware="Troldesh orShade, XTBL")

Lett me know if this doesnt help

View solution in original post

0 Karma

Path Finder

Nop.

(index=misp-events source="/var/scripts/events/21283.json") (tagname="misp-galaxy:continents="Asia"" OR tagname="misp-galaxy:targeted-region="Russia"" OR tag_name="misp-galaxy:ransomware="Troldesh orShade, XTBL"")

0 Karma