Reporting

How do I set up a daily report (24 hr window) for Blue Coat proxy logs to search for peer to peer traffic and file sharing?

wkinsey2015
New Member

Customer is asking for two daily report (covering 24 hour window) for the following:(bluecoat)

  • Peer to Peer traffic analysis report
  • File sharing system report

Search being used:

Sourcetype=bcoat_proxysg “key value pair that indicates filesharing activity”|table _time  “bluecoat host IP by field extraction name” “status code” “URL_String field extraction” “Categories Field Extraction”

Any suggestions/recommendations would be appreciated.

Thanks,
Bill

0 Karma

fdi01
Motivator

Hello

I think you are looking for this:

earliest=-1d@d+1h latest=-1d@d+2h   

try like :

Sourcetype=bcoat_proxysg “key value pair that indicates filesharing activity” earliest=-24h latest=now|table _time “bluecoat host IP by field extraction name” “status code” “URL_String field extraction” “Categories Field Extraction”
0 Karma

rkent
Explorer

According to bluecoat's reference, the category name is: "Peer-to-Peer (P2P)". Or from the url, catnum=83?

https://sitereview.bluecoat.com/catdesc.jsp?catnum=83

Here's the full list of categories: https://sitereview.bluecoat.com/categories.jsp

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...