Splunk Enterprise Security

How to search if a user received an email from a malicious threat actor.

Carlo16
Engager

Hi Splunk Experts,

I'm a newbie to splunk and have been tasked with finding out if a couple of our users (e.g user1@domain.com, user2.....) received malicious emails from a list of domains in that i have bow created a lookup (baddomains.csv) table for.

We have an index (index=emailgt) but the challenge is preparing a search query that would parse that index to the lookup table  (baddomains.csv) and then to match if any of the users interacted with these bad domains.

 

Thanks

Labels (2)
0 Karma
1 Solution

96nick
Communicator

What are the columns in your lookup? You can take a look at the linked thread at the bottom and follow along.

Here's a decent example: Say I had a list of IPs in a lookup file that looked like this:

ip_address report_name

1.2.3.4, kyle_report

2.3.4.5, kyle_report

88.11.22.33, sandy_report

I deem that the 3 IPs above are bad and I wanted to search my firewall logs to see if there were any hits. I could do a search like this:

 

index=fw_logs source=fw.log sourcetype=opsec [| inputlookup badIPs.csv | stats values(ip_address) AS search | format ]

 

 

Learned that one from this reply, let me know if that helped:

https://community.splunk.com/t5/Getting-Data-In/Search-for-all-events-for-IP-address-within-a-CSV-fi...

 

View solution in original post

0 Karma

96nick
Communicator

Heya,

There's a couple ways to do this (actually probably more than a couple). You can do it with the lookup command or the inputlookup command. An example of the inputlookup command would be to do something like:

 

index=emailgt <your base search> [|inputlookup baddomains.csv | fields baddomain | format]

 

The field in the search 'fields baddomain' should be the column name that matches what you want to limit the corresponding results in your base search to.

More info on that search and the specifics on the why it work is here.

Hope that helped!

0 Karma

Carlo16
Engager
Thanks Nick, To summarize, you reckon the query should look like: index=emailgt "user1@domain.com" [|inputlookup baddomains.csv | fields domains | format] ?? Didn't get much output from that query
0 Karma

96nick
Communicator

What are the columns in your lookup? You can take a look at the linked thread at the bottom and follow along.

Here's a decent example: Say I had a list of IPs in a lookup file that looked like this:

ip_address report_name

1.2.3.4, kyle_report

2.3.4.5, kyle_report

88.11.22.33, sandy_report

I deem that the 3 IPs above are bad and I wanted to search my firewall logs to see if there were any hits. I could do a search like this:

 

index=fw_logs source=fw.log sourcetype=opsec [| inputlookup badIPs.csv | stats values(ip_address) AS search | format ]

 

 

Learned that one from this reply, let me know if that helped:

https://community.splunk.com/t5/Getting-Data-In/Search-for-all-events-for-IP-address-within-a-CSV-fi...

 

0 Karma

Carlo16
Engager
Thanks @96nick ! that did the trick.
0 Karma
Get Updates on the Splunk Community!

Earn a $35 Gift Card for Answering our Splunk Admins & App Developer Survey

Survey for Splunk Admins and App Developers is open now! | Earn a $35 gift card!      Hello there,  Splunk ...

Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...

You’ve probably heard the latest about AppDynamics joining the Splunk Observability portfolio, deepening our ...

Monitoring Amazon Elastic Kubernetes Service (EKS)

As we’ve seen, integrating Kubernetes environments with Splunk Observability Cloud is a quick and easy way to ...