Splunk Enterprise Security

How to get a complete list with descriptions of correlation searches in the Splunk Enterprise Security app?

mjuhasz
Explorer

Is there any list available anywhere which contains all the correlation searches and their description together? I would like to present it to some stakeholders, but documentation contains only a few of them. I'm looking for something like the "Search View matrix" in the User Guide of the Splunk Enterprise Security app, but with all the correlation searches in it.

Thanks
Miklos

1 Solution

ekost
Splunk Employee
Splunk Employee

Yes. Use a REST search to expose the information in a table with the fields you're interested in. Example:

| rest /services/alerts/correlationsearches | rename eai:acl.app as app, title as csearch_name | table app security_domain csearch_name description

View solution in original post

martinr8
Engager

Using the search provide in the ES documentation did not list all of the correlation searches in our environment, especially the ones in other apps. I used this search to find them all

| rest /servicesNS/-/-/saved/searches splunk_server=local | where match('action.correlationsearch.enabled', "1|[Tt]|[Tt][Rr][Uu][Ee]")

ekost
Splunk Employee
Splunk Employee

For ES 4.6 and later, the REST endpoint to call has changed.
Sample from the ES admin docs: | rest splunk_server=local count=0 /services/saved/searches | where match('action.correlationsearch.enabled', "1|[Tt]|[Tt][Rr][Uu][Ee]") | rename eai:acl.app as app, title as csearch_name, action.correlationsearch.label as csearch_label, action.notable.param.security_domain as security_domain | table csearch_name, csearch_label, app, security_domain, description

mjuhasz
Explorer

Thank you for the update!

0 Karma

ekost
Splunk Employee
Splunk Employee

Yes. Use a REST search to expose the information in a table with the fields you're interested in. Example:

| rest /services/alerts/correlationsearches | rename eai:acl.app as app, title as csearch_name | table app security_domain csearch_name description

View solution in original post

Jason
Motivator

And if you want to include the actual search text, for analysis of what rules use what data sources for example, you can extend this answer to:

| rest /services/alerts/correlationsearches 
| rename eai:acl.app as app, title as csearch_name 
| join type=outer app csearch_name [ rest /services/saved/searches 
    | rename eai:acl.app as app, title as csearch_name search as csearch 
    | table app csearch_name csearch ] 
| table app security_domain csearch_name description csearch

mjuhasz
Explorer

Thank you! Elegant. 🙂

0 Karma