Splunk Enterprise Security

How to Get Contributing events from a notable event programatically

shravankumarkus
New Member

I want get contributing events for a particular notable event programatically.
Is there anyway that we can get from any splunk endpoint ?
i thought of a way by using drilldown search field in notable event and firing a search query ?
i see a field 'orig_sid' in notable event, any way that we can use this field and get

Any other ways that we can get contributing events for a notable event programatically ?

Any suggestions would really help me

0 Karma

woodcock
Esteemed Legend

The orig_sid should have encoded in it both the name of the search and the time the search ran. Based on that, you can use REST to pull up the search SPL and the cron of the search that ran, merge this with the time that it ran to re-run the same search over the same time window. There are 2 potential problems, though. New events that arrived late(r than the original search ran) might be present and match now that did not originally. Similarly, old events that were found originally may have aged/sized out of your indexers and not be found this time.

0 Karma

shravankumarkus
New Member

thanks for the response

i guess you are saying to rerun the search with same time range that the original correlation search ran

there is a field 'drilldown_search' which has the search criteria, can it be used ?

 <field k='drilldown_search'>
         <value>
             <text>| from datamodel:&quot;Threat_Intelligence&quot;.&quot;Threat_Activity&quot; | search threat_match_field=&quot;$threat_match_field$&quot; threat_match_value=&quot;$threat_match_value$&quot;</text>
         </value>
     </field>

orig_sid field is below

<field k='orig_sid'>
            <value>
                <text>scheduler__admin_REEtRVNTLVRocmVhdEludGVsbGlnZW5jZQ__RMD5ae7062088f029cdf_at_1558764000_9257</text>
            </value>
        </field>
0 Karma

koshyk
Super Champion

Good question, but I'm not sure you can link "A single contributing event" for your search, as it might happen due to multiple events. Hence even if we have a orig_sid, I'm not sure how can it link to an event.

Another trick you could do is, you could get the "drilldown search" programatically and then run it during the time. Is this OK with you? If yes, possibly can get it using REST endpoint of savedsearches .

0 Karma

shravankumarkus
New Member

thanks for the response

but drilldown search field has many escaped characters and it also has some values to be substituted like $threat_match_field$ , $threat_match_value$

<field k='drilldown_search'>
            <value>
                <text>| from datamodel:&quot;Threat_Intelligence&quot;.&quot;Threat_Activity&quot; | search threat_match_field=&quot;$threat_match_field$&quot; threat_match_value=&quot;$threat_match_value$&quot;</text>
            </value>
        </field>
0 Karma
Get Updates on the Splunk Community!

This Week's Community Digest - Splunk Community Happenings [9.26.22]

Get the latest news and updates from the Splunk Community here! Upcoming User Group Events! &#x1f44f; Check ...

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...