Security

Help with Search for multiple tasks

Cyberguru
Engager

Hey Splunk Community!

 

Working on a dashboard ( For Incident Response) in splunk but need some assistance initially with queries on the following in Splunk:

  • Computer or host showing if malicious
  • Logon info for other machines that a user has logged in for the ay
  • IP address of machine, Location or Country, Is it a VM, and Laptop
  • Active Directory info on user
  • Remote machine name - to find out what machine was used to remote into the Server on the last incident

Need this soon, would be appreciated.

Thanks Very much!

Labels (4)
Tags (3)
0 Karma

Cyberguru
Engager

Just need -malicious host for Symantec AV for e.g.

0 Karma

gcusello
Esteemed Legend

Hi @Cyberguru,

see in Splunkbase (apps.splunk.com) the Add-on to collect data and the App to display data.

Ciao.

Giuseppe

0 Karma

gcusello
Esteemed Legend

Hi @Cyberguru,

there isn't a general answer to your question because the searches depend on the data you have: e.g. if you speak of malicious host, this depends on the Antivirus or WAF or the IPS/IDS you're using.

So start from the technologies you're collecting logs, then see in Splunkbase (apps.splunk.com) if there's an App (usually there is!) that gives you the dashboards you need.

In addition I hint to install and see the Splunk Security Essentials App (https://splunkbase.splunk.com/app/3435) that contains many security searches and guides you in the data analysis.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

New Splunk Observability innovations: Deeper visibility and smarter alerting to ...

You asked, we delivered. Splunk Observability Cloud has several new innovations giving you deeper visibility ...

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...