Getting Data In

Suricata http logs - user path to domain

hegga
Explorer

Hi,

I'm trying to create a search which can be used to identify what "path" users has taken when they land on an interesting domain through the suricata http logs. I plan on presenting the results with a table and through a sankey diagram. However the search below is not working for me. Basically I try to identify if there are any relations between the domain field and the domain in the http_referer field.

So if example.com is the interesting domain, I'd like to identify how the user got there, for example:

bing.com ==> otherdomain.com ==> thirddomain.com ==> example.com

The search I've got so far is as following:

base search
| rex field=http_referer "//(?<referer_domain>.*?\.\w+)($|/)" 
| eval related_domains="example.com"
| streamstats current=f global=f window=1 values(related_domains) as last_related_domains
| eval related_domains=if(mvcount(last_related_domains) > mvcount(related_domains), last_related_domains, related_domains)
| eval related=if(domain IN(related_domains) OR referer_domain IN(related_domains), 1, 0)
| eval related_domains=if(related==1, mvdedup(mvappend(related_domains, last_related_domains, referer_domain, domain)), related_domains)
| streamstats current=f global=f window=1 values(related_domains) as last_related_domains
| table _time, host, http_status, http_method, domain, url, http_referer, referer_domain, related, related_domains, last_related_domains

I have to present the results both using the full url and by domains, but I've chosen to use the domains to establish relationship between domains, or that's at least what I'm trying to do. Can anyone help establish relationship between domains in a domain chain as described above?

Tags (3)
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...