How to search if a user received an email from a malicious threat actor.

[Carlo16]

Hi Splunk Experts,

I'm a newbie to splunk and have been tasked with finding out if a couple of our users (e.g user1@domain.com, user2.....) received malicious emails from a list of domains in that i have bow created a lookup (baddomains.csv) table for.

We have an index (index=emailgt) but the challenge is preparing a search query that would parse that index to the lookup table  (baddomains.csv) and then to match if any of the users interacted with these bad domains.

Thanks

[96nick]

Heya,

There's a couple ways to do this (actually probably more than a couple). You can do it with the lookup command or the inputlookup command. An example of the inputlookup command would be to do something like:

index=emailgt <your base search> [|inputlookup baddomains.csv | fields baddomain | format]

The field in the search 'fields baddomain' should be the column name that matches what you want to limit the corresponding results in your base search to.

More info on that search and the specifics on the why it work is here.

Hope that helped!

[Carlo16]

Thanks Nick, To summarize, you reckon the query should look like: index=emailgt "user1@domain.com" [|inputlookup baddomains.csv | fields domains | format] ?? Didn't get much output from that query

[96nick · Accepted solution]

What are the columns in your lookup? You can take a look at the linked thread at the bottom and follow along.

Here's a decent example: Say I had a list of IPs in a lookup file that looked like this:

ip_address report_name

1.2.3.4, kyle_report

2.3.4.5, kyle_report

88.11.22.33, sandy_report

I deem that the 3 IPs above are bad and I wanted to search my firewall logs to see if there were any hits. I could do a search like this:

index=fw_logs source=fw.log sourcetype=opsec [| inputlookup badIPs.csv | stats values(ip_address) AS search | format ]

Learned that one from this reply, let me know if that helped:

https://community.splunk.com/t5/Getting-Data-In/Search-for-all-events-for-IP-address-within-a-CSV-fi...

[Carlo16]

Thanks @96nick ! that did the trick.