Splunk Enterprise Security

How to group similar events into one event

callumring
New Member

Hi,

We have pulled logs from our Anti Virus software into splunk and are in process of trying to filter through what we actually want to track.

We want to track all events that relate to sites blocked for particular reasons EG:
'https://ads.converge-digital.com' blocked due to category 'Proxies & Translators'

We have a lot of different sites that are being blocked in the same way, so is there a way to group these all together so we can see everything that has been blocked by 'Proxies and Translators' as opposed to sifting through each individual event?

Thanks

0 Karma

wmyersas
Builder

You'll want to use |stats for this. Something like this:

index=ndx sourcetype=av domain=* blockedreason=*
| stats values(domain) as "Domains Blocked" by blockedreason
| rename blockedreason as "AV Policy Violation"

See https://docs.splunk.com/Documentation/Splunk/Latest/SearchReference/Stats for mroe details on what kinds of statistical functions you might want to use

callumring
New Member

So it seems as thought I can rename the title using this, but not the actual event that I want to group together.

It isnt the actual heading I want to rename and group, rather the list of all events that fall into that field. EG:
rename name='*' blocked due to category 'Advertisements & Pop-Ups' as "Blocked events - Advertisments and Pop Ups"
This will not work as it will not allow me to rename the whole event, just the heading (name) that it comes under.

0 Karma

wmyersas
Builder

I'm fairly certain the example I provided is still what you're describing: it'll group all the blocked domains by the reason they're blocked (of course, substitute actual field names vs the example)

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...