Tokens - Drill Down Search

[Sultan77]

Hello everyone,

I’ve encountered a problem while setting up a correlation search. For instance, when I use the following query:

index=windows AND EventCode=4624

I end up getting multiple alerts. To refine this, I attempted to add a Drill Down Search like this:

index=windows AND EventCode=4624 host="$host$"

However, this returns no results. Does anyone have suggestions or ideas that might help resolve this? Any input would be greatly appreciated!

[livehybrid]

Hi @Sultan77 

I think there may be some confusion in this thread. It sounds like you're creating an Enterprise Security Correlation Search, right? The screenshots you posted where you specify host=$host$ in the DrillDown search is for when a notable event has been created and a security analyst is viewing it. They'll be presented a DrillDown search link designed to help take them to the event(s) which caused the notable to fire. 

Is that your understanding? Is it the drilldown you are wanting to restrict further, rather than the initial correlation search which created the notables? If so you need to find other fields in the returned data that can limit the events returned in the drilldown, such as as eventID.

Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards

Will

[Sultan77]

Dear @livehybrid 

You're right, that's exactly what I'm attempting to do.

As for limiting the events returned, I'm working on specifying something distinctive, like the host that triggered the Event ID or the user involved.

[gcusello]

Hi @Sultan77 ,

if you want to open in drilldown only the events related to the results of the correlation search, you have to insert in the drilldown search a subsearch containing the correlation search.

in other words, if your correlation search lists some hosts, you should use a drilldown search like the following:

<the_same_search_conditions_of_the_correlation_search>
[ search <the_full_correlation_search> | fields host ]

Ciao.

Giuseppe

[ITWhisperer]

Is this in a dashboard?

Are you using Classic SimpleXML or Studio?

Where is the token being set?

[Sultan77]

Dear @ITWhisperer ,

I am trying to set a correlation search. ( content management -> correlation search)

[gcusello]

Hi @Sultan77 ,

you cannot use a token in a Correlation Search, because it is automatically executed and you canno pass to it a parameter.

Ciao.

Giuseppe