Splunk Enterprise Security

How to search if a user received an email from a malicious threat actor.

Carlo16
Engager

Hi Splunk Experts,

I'm a newbie to splunk and have been tasked with finding out if a couple of our users (e.g user1@domain.com, user2.....) received malicious emails from a list of domains in that i have bow created a lookup (baddomains.csv) table for.

We have an index (index=emailgt) but the challenge is preparing a search query that would parse that index to the lookup table  (baddomains.csv) and then to match if any of the users interacted with these bad domains.

 

Thanks

Labels (2)
0 Karma
1 Solution

96nick
Communicator

What are the columns in your lookup? You can take a look at the linked thread at the bottom and follow along.

Here's a decent example: Say I had a list of IPs in a lookup file that looked like this:

ip_address report_name

1.2.3.4, kyle_report

2.3.4.5, kyle_report

88.11.22.33, sandy_report

I deem that the 3 IPs above are bad and I wanted to search my firewall logs to see if there were any hits. I could do a search like this:

 

index=fw_logs source=fw.log sourcetype=opsec [| inputlookup badIPs.csv | stats values(ip_address) AS search | format ]

 

 

Learned that one from this reply, let me know if that helped:

https://community.splunk.com/t5/Getting-Data-In/Search-for-all-events-for-IP-address-within-a-CSV-fi...

 

View solution in original post

0 Karma

96nick
Communicator

Heya,

There's a couple ways to do this (actually probably more than a couple). You can do it with the lookup command or the inputlookup command. An example of the inputlookup command would be to do something like:

 

index=emailgt <your base search> [|inputlookup baddomains.csv | fields baddomain | format]

 

The field in the search 'fields baddomain' should be the column name that matches what you want to limit the corresponding results in your base search to.

More info on that search and the specifics on the why it work is here.

Hope that helped!

0 Karma

Carlo16
Engager
Thanks Nick, To summarize, you reckon the query should look like: index=emailgt "user1@domain.com" [|inputlookup baddomains.csv | fields domains | format] ?? Didn't get much output from that query
0 Karma

96nick
Communicator

What are the columns in your lookup? You can take a look at the linked thread at the bottom and follow along.

Here's a decent example: Say I had a list of IPs in a lookup file that looked like this:

ip_address report_name

1.2.3.4, kyle_report

2.3.4.5, kyle_report

88.11.22.33, sandy_report

I deem that the 3 IPs above are bad and I wanted to search my firewall logs to see if there were any hits. I could do a search like this:

 

index=fw_logs source=fw.log sourcetype=opsec [| inputlookup badIPs.csv | stats values(ip_address) AS search | format ]

 

 

Learned that one from this reply, let me know if that helped:

https://community.splunk.com/t5/Getting-Data-In/Search-for-all-events-for-IP-address-within-a-CSV-fi...

 

0 Karma

Carlo16
Engager
Thanks @96nick ! that did the trick.
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...