Splunk Enterprise Security

Correlation Search question (Enterprise Security)

Builder

Hello,

This is a correlation search included with Enterprise Security that detects and alerts for potential spyware activity:

| `src_dest_tracker("allowed")` | lookup local=true ip_spyware_lookup src OUTPUTNEW src_ip as src_spyware_ip,src_description,src_is_spyware | lookup local=true ip_spyware_lookup dest OUTPUTNEW dest_ip as dest_spyware_ip,dest_description,dest_is_spyware | search dest_is_spyware=true OR src_is_spyware=true | eval spyware_ip=if(dest_is_spyware=="true",dest_spyware_ip,spyware_ip) | eval spyware_ip=if(src_is_spyware=="true",src_spyware_ip,spyware_ip) | eval spyware_description=if(dest_is_spyware=="true",dest_description,spyware_description) | eval spyware_description=if(src_is_spyware=="true",src_description,spyware_description) | fields + sourcetype,src,dest,spyware_ip,spyware_description

My question is, is there a way to tweak this search so that it only alerts when there are more than X number of events? In other words, let me know when an IP address triggers this rule 5 times (within a 24 hour period).

I thought it was as simple as adding: "| search count>5" to the end of the search string but it didn't work.

Thanks for any tips!

1 Solution

Splunk Employee
Splunk Employee

Hi,

First and obligatory answer is upgrade, 3.0's version is much easier to read because of architectural improvements.... That said, I'd put stats count(spyware_ip) as spyware_count by spyware_ip | search spyware_count>5 at the end.

View solution in original post

Splunk Employee
Splunk Employee

Hi,

First and obligatory answer is upgrade, 3.0's version is much easier to read because of architectural improvements.... That said, I'd put stats count(spyware_ip) as spyware_count by spyware_ip | search spyware_count>5 at the end.

View solution in original post

Builder

This worked, thanks for the help!

0 Karma

Builder

Hi, thanks, I will try this in the morning and let you know the results!

... I did try the upgrade to ES 3 but had a few issues so I had to rollback, but it's good to know that the correlation searches are more efficient in ES 3.

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!