Splunk Enterprise Security

How to move multivalue fields as separate columns?

fedejko
Explorer

Hi, I have the following case which I can't get around.

My search returns something like this:

fedejko_1-1653388455827.png

In order to help security analysts with some useful information, from a lookup we are adding MITRE technique ID  and some useful information about how to detect this particular technique.

What I wanted to do is to move the multivalue fields from mitre_technique_id column as the separate columns named exactly like the MITRE ID, and in that column I wanted to include the information about the detection tips for that technique.

I was trying something with foreach, transpose, mvexpand but with no good results.

Does anyone knows how to achieve it? The end result would look like this:

fedejko_2-1653388970492.png

Thanks in advance!

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| streamstats count as row 
| eval iddetect=mvzip(mitre_technique_id,mitre_detection,"|")
| mvexpand iddetect
| rex field=iddetect "(?<_name>[^\|]+)\|(?<_value>.+)"
| eval {_name}=_value
| fields - iddetect mitre_technique_id mitre_detection
| stats values(*) as * by row
| fields - row

View solution in original post

somesoni2
Revered Legend

Give this a try

YOur current search giving field host, dest, user, mitre_technique_id mitre_detection
| eval iddetect=mvzip(mitre_technique_id,mitre_detection,"|")
| mvexpand iddetect
| rex field=iddetect "(?<mitre_technique_id>[^\|]+)\|(?<mitre_detection>.+)"
| fields - iddetect
| eval common_key=host."##".dest."##".user
| xyseries common_key mitre_technique_id mitre_detection
| rex field=common_key "(?<host>[^#]+)##(?<dest>.+)##(?<user>.+)"
| fields - common_key
| table host dest user *
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| streamstats count as row 
| eval iddetect=mvzip(mitre_technique_id,mitre_detection,"|")
| mvexpand iddetect
| rex field=iddetect "(?<_name>[^\|]+)\|(?<_value>.+)"
| eval {_name}=_value
| fields - iddetect mitre_technique_id mitre_detection
| stats values(*) as * by row
| fields - row

fedejko
Explorer

Solved by adding (?s) in front of the regex.

0 Karma

fedejko
Explorer

Thanks, I see the light in the tunnel 🙂

How to modify that regex so it captures remaining lines of the paragraph?

fedejko_1-1653397241943.png

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try this

| rex field=iddetect "(?ms)(?<_name>[^\|]+)\|(?<_value>.+)"
Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...