Splunk Enterprise Security

How to move multivalue fields as separate columns?

fedejko
Explorer

Hi, I have the following case which I can't get around.

My search returns something like this:

fedejko_1-1653388455827.png

In order to help security analysts with some useful information, from a lookup we are adding MITRE technique ID  and some useful information about how to detect this particular technique.

What I wanted to do is to move the multivalue fields from mitre_technique_id column as the separate columns named exactly like the MITRE ID, and in that column I wanted to include the information about the detection tips for that technique.

I was trying something with foreach, transpose, mvexpand but with no good results.

Does anyone knows how to achieve it? The end result would look like this:

fedejko_2-1653388970492.png

Thanks in advance!

0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| streamstats count as row 
| eval iddetect=mvzip(mitre_technique_id,mitre_detection,"|")
| mvexpand iddetect
| rex field=iddetect "(?<_name>[^\|]+)\|(?<_value>.+)"
| eval {_name}=_value
| fields - iddetect mitre_technique_id mitre_detection
| stats values(*) as * by row
| fields - row

View solution in original post

somesoni2
Revered Legend

Give this a try

YOur current search giving field host, dest, user, mitre_technique_id mitre_detection
| eval iddetect=mvzip(mitre_technique_id,mitre_detection,"|")
| mvexpand iddetect
| rex field=iddetect "(?<mitre_technique_id>[^\|]+)\|(?<mitre_detection>.+)"
| fields - iddetect
| eval common_key=host."##".dest."##".user
| xyseries common_key mitre_technique_id mitre_detection
| rex field=common_key "(?<host>[^#]+)##(?<dest>.+)##(?<user>.+)"
| fields - common_key
| table host dest user *
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| streamstats count as row 
| eval iddetect=mvzip(mitre_technique_id,mitre_detection,"|")
| mvexpand iddetect
| rex field=iddetect "(?<_name>[^\|]+)\|(?<_value>.+)"
| eval {_name}=_value
| fields - iddetect mitre_technique_id mitre_detection
| stats values(*) as * by row
| fields - row

fedejko
Explorer

Solved by adding (?s) in front of the regex.

0 Karma

fedejko
Explorer

Thanks, I see the light in the tunnel 🙂

How to modify that regex so it captures remaining lines of the paragraph?

fedejko_1-1653397241943.png

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try this

| rex field=iddetect "(?ms)(?<_name>[^\|]+)\|(?<_value>.+)"
Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...