Splunk Enterprise Security

Correlation Search question (Enterprise Security)

echojacques
Builder

Hello,

This is a correlation search included with Enterprise Security that detects and alerts for potential spyware activity:

| `src_dest_tracker("allowed")` | lookup local=true ip_spyware_lookup src OUTPUTNEW src_ip as src_spyware_ip,src_description,src_is_spyware | lookup local=true ip_spyware_lookup dest OUTPUTNEW dest_ip as dest_spyware_ip,dest_description,dest_is_spyware | search dest_is_spyware=true OR src_is_spyware=true | eval spyware_ip=if(dest_is_spyware=="true",dest_spyware_ip,spyware_ip) | eval spyware_ip=if(src_is_spyware=="true",src_spyware_ip,spyware_ip) | eval spyware_description=if(dest_is_spyware=="true",dest_description,spyware_description) | eval spyware_description=if(src_is_spyware=="true",src_description,spyware_description) | fields + sourcetype,src,dest,spyware_ip,spyware_description

My question is, is there a way to tweak this search so that it only alerts when there are more than X number of events? In other words, let me know when an IP address triggers this rule 5 times (within a 24 hour period).

I thought it was as simple as adding: "| search count>5" to the end of the search string but it didn't work.

Thanks for any tips!

1 Solution

jcoates_splunk
Splunk Employee
Splunk Employee

Hi,

First and obligatory answer is upgrade, 3.0's version is much easier to read because of architectural improvements.... That said, I'd put stats count(spyware_ip) as spyware_count by spyware_ip | search spyware_count>5 at the end.

View solution in original post

jcoates_splunk
Splunk Employee
Splunk Employee

Hi,

First and obligatory answer is upgrade, 3.0's version is much easier to read because of architectural improvements.... That said, I'd put stats count(spyware_ip) as spyware_count by spyware_ip | search spyware_count>5 at the end.

echojacques
Builder

This worked, thanks for the help!

0 Karma

echojacques
Builder

Hi, thanks, I will try this in the morning and let you know the results!

... I did try the upgrade to ES 3 but had a few issues so I had to rollback, but it's good to know that the correlation searches are more efficient in ES 3.

0 Karma
Get Updates on the Splunk Community!

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...