Getting Data In

import csv file and only store diffs from last import of same file (autoruns data)

johnmccash
Explorer

I'm interested in storing csv output from the sysinternals autoruns tool in Splunk. But I will be pulling in from a rather large number of hosts, and most of the data will be the same from dump to dump. What I'm really interested in are the additions, removals, and changes. Is there any way to import the csv but have Splunk only record lines that are added, removed, or changed, from the last time the autoruns dump from a particular system was imported?

Tags (4)
0 Karma

mhorch
New Member

This is what i use for my threat hunting.

<#
Collect AutoRuns Records
This script is used to gather autoruns data for threat hunting.

>

.\autorunsc64.exe -accepteula -a * -s -h -m -ct -nobanner > autoruns.csv

$directory = "C:\"
$x1 = Get-ChildItem -File autoruns.csv -ErrorAction SilentlyContinue | select Name, FullName

$csvExportPath = Join-Path $directory $x1.Name
$createCSV = "$csvExportPath"+".csv"
$renamedReferenceCSV = "$directory"+"ReferenceAutoRuns.csv"
$renamedDifferenceCSV = "$directory"+"DifferenceAutoRuns.csv"
$deltaFile = "$directory"+"DeltaAutoRuns.csv"

if (!(Test-Path $renamedReferenceCSV)){Rename-Item $x1.FullName -NewName "ReferenceAutoRuns.csv"
Copy-Item $renamedReferenceCSV -Destination $deltaFile

}else{

if (!(Test-Path $renamedDifferenceCSV) -and (Test-Path $renamedReferenceCSV)){Rename-Item $x1.FullName -NewName "DifferenceAutoRuns.csv"

if ((Test-Path $renamedReferenceCSV) -and (Test-Path $renamedDifferenceCSV))
{
$importReferenceCSV = Import-Csv -Delimiter "t" $renamedReferenceCSV -ErrorAction SilentlyContinue
$importDifferenceCSV = Import-Csv -Delimiter "
t" $renamedDifferenceCSV -ErrorAction SilentlyContinue

Compare-Object -ReferenceObject $importReferenceCSV -DifferenceObject $importDifferenceCSV |
Select-Object -ExpandProperty InputObject|
Export-Csv $deltaFile -NoTypeInformation
Start-Sleep 10
#Clean Up Old Files
Remove-Item $renamedDifferenceCSV

}

}
}

0 Karma

johnmccash
Explorer

Surely somebody out there has done this? It's a perfectly reasonable use case...
John

0 Karma

johnmccash
Explorer

Just freshening this up, so maybe somebody will answer it...

0 Karma

renjith_nair
SplunkTrust
SplunkTrust
0 Karma

somesoni2
SplunkTrust
SplunkTrust

You can write a script which will compare last two dump file (csv) from the host and log the changes. I believe there should be scripts like this already available on web.

johnmccash
Explorer

Can you point me to one? I did look, but haven't found anything.
Thanks

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...