Splunk Enterprise Security

API AWS query question

havatz
Explorer

Hi

This is my API AWS query:

"search index=aws userIdentity.type=Root eventName=ConsoleLogin earliest=-10d  | rex field=_raw MFAUsed\D\D\s\D(?P<Mfa>\D?\S) | rex field=_raw principalId\D:\s\D(?P<principalId>\d*)" | stats count by principalId"

its working and im getting results.

Now I need your help with add the field that I parse (Mfa)

and to add Mfa="No" to the query

but its not showing resutls.

I tried to do something like that:

"search index="aws" (userIdentity.type="Root" eventName="ConsoleLogin" Mfa="No*" earliest=-10d | rex field=_raw MFAUsed\D\D\s\D(?P<Mfa>\D?\S) | rex field=_raw principalId\D:\s\D(?P<principalId>\d*)"

What Im missing?

Thanks!

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Mfa hasn't been extracted until after the rex (that extracts it), so try something like:

"search index="aws" (userIdentity.type="Root" eventName="ConsoleLogin" earliest=-10d | rex field=_raw MFAUsed\D\D\s\D(?P<Mfa>\D?\S) | where Mfa="No*" | rex field=_raw principalId\D:\s\D(?P<principalId>\d*)"

 

0 Karma

havatz
Explorer

"search index="aws" userIdentity.type="Root" eventName="ConsoleLogin" earliest=-10d | rex field=_raw MFAUsed\D\D\s\D(?P<Mfa>\D?\S) | where Mfa="No*" | rex field=_raw principalId\D:\s\D(?P<principalId>\d*) | stats count by principalId"

Got this error:

"messages": [
{
"type": "FATAL",
"text": "Error in 'where' command: The expression is malformed. The factor is missing."

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You possibly need to add in escaping of the double-quotes(?)

"search index=\"aws\" userIdentity.type=\"Root\" eventName=\"ConsoleLogin\" earliest=-10d | rex field=_raw MFAUsed\D\D\s\D(?P<Mfa>\D?\S) | where Mfa=\"No*\" | rex field=_raw principalId\D:\s\D(?P<principalId>\d*) | stats count by principalId"

 

0 Karma
Get Updates on the Splunk Community!

Security Professional: Sharpen Your Defenses with These .conf25 Sessions

Sooooooooooo, guess what. .conf25 is almost here, and if you're on the Security Learning Path, this is your ...

First Steps with Splunk SOAR

Our first step was to gather a list of the playbooks we wanted and to sort them by priority.  Once this list ...

How To Build a Self-Service Observability Practice with Splunk Observability Cloud

If you’ve read our previous post on self-service observability, you already know what it is and why it ...