Reporting

How do I set up a daily report (24 hr window) for Blue Coat proxy logs to search for peer to peer traffic and file sharing?

wkinsey2015
New Member

Customer is asking for two daily report (covering 24 hour window) for the following:(bluecoat)

  • Peer to Peer traffic analysis report
  • File sharing system report

Search being used:

Sourcetype=bcoat_proxysg “key value pair that indicates filesharing activity”|table _time  “bluecoat host IP by field extraction name” “status code” “URL_String field extraction” “Categories Field Extraction”

Any suggestions/recommendations would be appreciated.

Thanks,
Bill

0 Karma

fdi01
Motivator

Hello

I think you are looking for this:

earliest=-1d@d+1h latest=-1d@d+2h   

try like :

Sourcetype=bcoat_proxysg “key value pair that indicates filesharing activity” earliest=-24h latest=now|table _time “bluecoat host IP by field extraction name” “status code” “URL_String field extraction” “Categories Field Extraction”
0 Karma

rkent
Explorer

According to bluecoat's reference, the category name is: "Peer-to-Peer (P2P)". Or from the url, catnum=83?

https://sitereview.bluecoat.com/catdesc.jsp?catnum=83

Here's the full list of categories: https://sitereview.bluecoat.com/categories.jsp

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

REGISTER NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more ...

Security Highlights | November 2022 Newsletter

 November 2022 2022 Gartner Magic Quadrant for SIEM: Splunk Named a Leader for the 9th Year in a RowSplunk is ...

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...