Splunk Enterprise Security

How to group similar events into one event

callumring
New Member

Hi,

We have pulled logs from our Anti Virus software into splunk and are in process of trying to filter through what we actually want to track.

We want to track all events that relate to sites blocked for particular reasons EG:
'https://ads.converge-digital.com' blocked due to category 'Proxies & Translators'

We have a lot of different sites that are being blocked in the same way, so is there a way to group these all together so we can see everything that has been blocked by 'Proxies and Translators' as opposed to sifting through each individual event?

Thanks

0 Karma

wmyersas
Builder

You'll want to use |stats for this. Something like this:

index=ndx sourcetype=av domain=* blockedreason=*
| stats values(domain) as "Domains Blocked" by blockedreason
| rename blockedreason as "AV Policy Violation"

See https://docs.splunk.com/Documentation/Splunk/Latest/SearchReference/Stats for mroe details on what kinds of statistical functions you might want to use

callumring
New Member

So it seems as thought I can rename the title using this, but not the actual event that I want to group together.

It isnt the actual heading I want to rename and group, rather the list of all events that fall into that field. EG:
rename name='*' blocked due to category 'Advertisements & Pop-Ups' as "Blocked events - Advertisments and Pop Ups"
This will not work as it will not allow me to rename the whole event, just the heading (name) that it comes under.

0 Karma

wmyersas
Builder

I'm fairly certain the example I provided is still what you're describing: it'll group all the blocked domains by the reason they're blocked (of course, substitute actual field names vs the example)

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...